9c413c59f5f92d00de289c171c4ab3b2d69da1b8000a860c9d514f615c54b6b5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Size 60KB
Sample240619-291easwepe
SHA256 9c413c59f5f92d00de289c171c4ab3b2d69da1b8000a860c9d514f615c54b6b5
MD5 011ae254aa94bdf84c196a8a11cbb4f6
SHA1 30a232c82e9fe9ef0666afcb0fdd02636069a7e8
SHA512 14108b1f42ffef4d740f37f9829f2cb5fdde90ec33750debc249c6da69910c022d9e81287a3ea131eb08c4cd20d9c67934b43c89050a9a42a80d72059fef5be8
SSDEEP 1536:yNAXXS9lhBSmIV6HYJ9AVX4kNjy/ARwkRHzcbyIeZc/MtIIKeM:yGHS9l6V6HYJWpRy/AIzK63It
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware aspackv2 stealer

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000700000002345f-4.dat	aspack_v212_v242

Loads dropped DLL 5 IoCs

pid	Process
2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{557B9038-FC87-453C-8B08-32D85F46EAC4}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\COMCLL.SR_	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\COMCLL.SR_	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\usr.dll	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EXEINFO.DLL	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EXEINFO.DLL	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\floders.ini	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
File created	C:\Windows\Downloaded Program Files\search.dll	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\long.bak	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{557B9038-FC87-453C-8B08-32D85F46EAC4}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{557B9038-FC87-453C-8B08-32D85F46EAC4}\Compatibility Flags = "0"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\ProgID\ = "Apron.apronA.1"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\EXEINFO.DLL"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}\1.0\HELPDIR	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\VersionIndependentProgID	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ExeInfo.ExeInfoShlExt\CurVer\ = "ExeInfo.ExeInfoShlExt.1"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\ProgID	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\VersionIndependentProgID\ = "ExeInfo.ExeInfoShlExt"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{E61B742A-4533-4710-A53D-0A033CF935CB}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}\1.0\FLAGS\ = "0"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3465A97B-9AB2-4481-9A00-1095E9CF193B}\ProxyStubClsid32	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06F95BB1-BBE2-4CC2-B83A-304ACEB38EEF}\TypeLib\ = "{AFF58917-C0BA-4776-9A4C-2C6E124875A4}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ExeInfo.ExeInfoShlExt.1\CLSID\ = "{E61B742A-4533-4710-A53D-0A033CF935CB}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}\1.0\FLAGS	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Apron.apronA\CurVer\ = "Apron.apronA.1"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\0\win32\ = "C:\\Windows\\Downloaded Program Files\\search.dll"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ExeInfo.ExeInfoShlExt.1\CLSID	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\InprocServer32	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\InprocServer32\ = "C:\\Windows\\SysWow64\\EXEINFO.DLL"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ShellEx\{00021500-0000-0000-C000-000000000046}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3465A97B-9AB2-4481-9A00-1095E9CF193B}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\HELPDIR\ = "C:\\Windows\\Downloaded Program Files\\"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\Programmable	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}\1.0\ = "ExeInfo 1.0 Type Library"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\ProgID\ = "ExeInfo.ExeInfoShlExt.1"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Apron.apronA\ = "apronA Class"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Apron.apronA\CLSID\ = "{557B9038-FC87-453C-8B08-32D85F46EAC4}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06F95BB1-BBE2-4CC2-B83A-304ACEB38EEF}\ = "IapronA"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06F95BB1-BBE2-4CC2-B83A-304ACEB38EEF}\TypeLib\Version = "1.0"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ExeInfo.ExeInfoShlExt\ = "ExeInfoShlExt Class"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06F95BB1-BBE2-4CC2-B83A-304ACEB38EEF}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Apron.apronA\CLSID	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\ProgID	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\VersionIndependentProgID\ = "Apron.apronA"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06F95BB1-BBE2-4CC2-B83A-304ACEB38EEF}\ProxyStubClsid32	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ShellEx	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3465A97B-9AB2-4481-9A00-1095E9CF193B}\TypeLib\Version = "1.0"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\InprocServer32\ = "C:\\Windows\\SysWow64\\usr.dll"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\FLAGS	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\FLAGS\ = "0"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\HELPDIR	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\search.dll"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\InprocServer32\ThreadingModel = "Apartment"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ExeInfo.ExeInfoShlExt.1\ = "ExeInfoShlExt Class"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3465A97B-9AB2-4481-9A00-1095E9CF193B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Apron.apronA	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06F95BB1-BBE2-4CC2-B83A-304ACEB38EEF}\ = "IapronA"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}\1.0\0	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\ = "apronA Class"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}\InprocServer32\ThreadingModel = "Apartment"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\ = "ExeInfoShlExt Class"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3465A97B-9AB2-4481-9A00-1095E9CF193B}\TypeLib\ = "{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\InprocServer32	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF58917-C0BA-4776-9A4C-2C6E124875A4}\1.0\0\win32	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ExeInfo.ExeInfoShlExt.1	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\TypeLib	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Apron.apronA.1\ = "apronA Class"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{557B9038-FC87-453C-8B08-32D85F46EAC4}	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\VersionIndependentProgID	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E61B742A-4533-4710-A53D-0A033CF935CB}\TypeLib\ = "{68F63AE5-AB1F-44DB-A3A9-38865ED0DC52}"	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2464	2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe	93
PID 2308 wrote to memory of 2464	2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe	93
PID 2308 wrote to memory of 2464	2308	011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe	93
PID 2464 wrote to memory of 4516	2464	cmd.exe	95
PID 2464 wrote to memory of 4516	2464	cmd.exe	95
PID 2464 wrote to memory of 4516	2464	cmd.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4516	attrib.exe

C:\Users\Admin\AppData\Local\Temp\011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\long.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\attrib.exe
    attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\011ae254aa94bdf84c196a8a11cbb4f6_JaffaCakes118.exe"
    3⤵
    - Views/modifies file attributes
    PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EXEINFO.DLL

Path C:\Windows\SysWOW64\EXEINFO.DLL
Size 84KB
SHA256 ff497f39586bb3b70df374bd38eb18aea46c01827f4b56c68386cdc2cc70dc1e
MD5 8d5e259ebe37c67ffdcf835fa0733733
SHA1 8780dee334a93a167e70d96ddd7ad28e31f0dfab
SHA512 70d4ec89d34dab96c2d66d7379d8eaa49f1a217b92f6f9e7e7c62fbaafed65aa7fe2dba6c5623360d187aa18ec75a25640a6bba6a03c70e76a29bf1b0b0e599d
SSDEEP 1536:rcE75jWWxkOiKmC/KMg/5soildK5UygUDU0M0jlsTBs:x9j/x7iKmC/KMg/5Sl2gUI0zUBs
MD5 SHA1 SHA512 SSDEEP

Submit Download

usr.dll

Path C:\Windows\SysWOW64\usr.dll
Size 41KB
SHA256 69a43c5d0c2fb302e18b00c279895c765e88db9346d82e1b41f218ebb481fd18
MD5 525d09e15c97a0b3c1db3da1f9b228ad
SHA1 4669255c4c977064701113e55ebfa56cadf47711
SHA512 8af515aa6eadb6101ce69a929459e95ebb025008cd1190a208df97c4cb97de68c34704420d8bbd07e9084eb176cd04d000c7e7a99034deec7cf7d3d27fa2da5d
SSDEEP 768:Gs8x98YAGwHq5UWeloZgUV4y7H5WDG/cn11wCH0zflmxTha5uB:GsoildK5UygUDU0M0jlsTB
MD5 SHA1 SHA512 SSDEEP

Submit Download

long.bat

Path \??\c:\long.bat
Size 340B
SHA256 e2efd4d678d6ff08f2e369f834abdc92e7047d295d69f3f910c463669236fdca
MD5 912c7a33f03fb326bb11a93686278f58
SHA1 a2a4a52294f7c0c5efc66b23248207bd685c9f95
SHA512 5627d938feb0b45b384f01516c1ccb8b0f548a3edbdcbe965820a19271f090be716f2ea0d35e9a574a4d14fef2af32ca51f2c3a794f96e6d1cc6518a8dd61696
MD5 SHA1 SHA512

Submit Download

memory/2308-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2308-6-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/2308-24-0x0000000000B80000-0x0000000000B95000-memory.dmp

Download

memory/2308-37-0x0000000000B80000-0x0000000000B95000-memory.dmp

Download

memory/2308-36-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/2308-35-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads