Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 07:34
Static task
static1
Behavioral task
behavioral1
Sample
0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe
-
Size
244KB
-
MD5
0411fbf6288de3e978aefd69af73d00e
-
SHA1
810344528cdf8b82cb9f9694ac607690c36961f8
-
SHA256
c3b38963d437f369539cd22a21f83105f2febb99dc6feb30434f2f0bbb2f5d42
-
SHA512
35ca2b2e6d7fa3de002d831d2de2fc64a4bb87181610f6760c83105e2f5edbd68a4004f864784fe1ca8ba4f4d0ce2034dbcd541fc8d011ab26a3724dd20ee772
-
SSDEEP
3072:exBcTBPt+MxJwVEi/8HAuPX6HGJfKV2DVLoF4x7H9PoST:MBEBl+ywVEi/8HAuiHCftDVLoF4B9hT
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1524 attrib.exe 4004 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exeinl9632.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation inl9632.tmp -
Executes dropped EXE 1 IoCs
Processes:
inl9632.tmppid process 3340 inl9632.tmp -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4488 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\datread\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\ = "Password Edit Ctrl" regsvr32.exe -
Drops file in Program Files directory 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
runonce.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
Processes:
IEXPLORE.EXEiexplore.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BF926298-2ED7-11EF-A084-4A7C5F4B2F01} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113956" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113956" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113956" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2488698658" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2482761114" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2482761114" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
Processes:
reg.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?n" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?n" reg.exe -
Modifies registry class 56 IoCs
Processes:
regsvr32.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\PIPI\\pwdedit.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\TypeLib\ = "{7E818FB4-EB7F-455A-B673-F994C13CEEA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\TypeLib\ = "{7E818FB4-EB7F-455A-B673-F994C13CEEA0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl\CurVer\ = "PwdEdit.PwdEditCtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\TypeLib\ = "{7E818FB4-EB7F-455A-B673-F994C13CEEA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\ = "PwdEditCtrl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\PIPI" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl.1\ = "PwdEditCtrl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl.1\CLSID\ = "{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\AppID = "{327DB191-294E-4425-B49B-77113C2C29B2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H) reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\ProgID\ = "PwdEdit.PwdEditCtrl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\VersionIndependentProgID\ = "PwdEdit.PwdEditCtrl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\ = "IPwdEditCtrl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E} reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl\ = "PwdEditCtrl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7E818FB4-EB7F-455A-B673-F994C13CEEA0}\1.0\ = "PwdEdit 1.0 ÀàÐÍ¿â" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\datread\\3.bat\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\PIPI\\pwdedit.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PwdEdit.PwdEditCtrl\CLSID\ = "{1C6B98DA-0AB6-4CCB-A528-AB47E9376660}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{320D924A-9410-4862-B7E8-A083CE0B2FBC}\ = "IPwdEditCtrl" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exeinl9632.tmpdescription pid process Token: SeIncBasePriorityPrivilege 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3340 inl9632.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4304 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4304 iexplore.exe 4304 iexplore.exe 4704 IEXPLORE.EXE 4704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.execmd.execmd.execmd.exeiexplore.execmd.exerundll32.exerunonce.exeinl9632.tmpdescription pid process target process PID 2212 wrote to memory of 4864 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2212 wrote to memory of 4864 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2212 wrote to memory of 4864 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 4864 wrote to memory of 4488 4864 cmd.exe regsvr32.exe PID 4864 wrote to memory of 4488 4864 cmd.exe regsvr32.exe PID 4864 wrote to memory of 4488 4864 cmd.exe regsvr32.exe PID 2212 wrote to memory of 4084 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2212 wrote to memory of 4084 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2212 wrote to memory of 4084 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 4084 wrote to memory of 1136 4084 cmd.exe cmd.exe PID 4084 wrote to memory of 1136 4084 cmd.exe cmd.exe PID 4084 wrote to memory of 1136 4084 cmd.exe cmd.exe PID 1136 wrote to memory of 4304 1136 cmd.exe iexplore.exe PID 1136 wrote to memory of 4304 1136 cmd.exe iexplore.exe PID 1136 wrote to memory of 4552 1136 cmd.exe rundll32.exe PID 1136 wrote to memory of 4552 1136 cmd.exe rundll32.exe PID 1136 wrote to memory of 4552 1136 cmd.exe rundll32.exe PID 1136 wrote to memory of 2108 1136 cmd.exe cmd.exe PID 1136 wrote to memory of 2108 1136 cmd.exe cmd.exe PID 1136 wrote to memory of 2108 1136 cmd.exe cmd.exe PID 4304 wrote to memory of 4704 4304 iexplore.exe IEXPLORE.EXE PID 4304 wrote to memory of 4704 4304 iexplore.exe IEXPLORE.EXE PID 4304 wrote to memory of 4704 4304 iexplore.exe IEXPLORE.EXE PID 2108 wrote to memory of 1928 2108 cmd.exe reg.exe PID 2108 wrote to memory of 1928 2108 cmd.exe reg.exe PID 2108 wrote to memory of 1928 2108 cmd.exe reg.exe PID 2108 wrote to memory of 4192 2108 cmd.exe reg.exe PID 2108 wrote to memory of 4192 2108 cmd.exe reg.exe PID 2108 wrote to memory of 4192 2108 cmd.exe reg.exe PID 2108 wrote to memory of 4692 2108 cmd.exe reg.exe PID 2108 wrote to memory of 4692 2108 cmd.exe reg.exe PID 2108 wrote to memory of 4692 2108 cmd.exe reg.exe PID 2212 wrote to memory of 3340 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe inl9632.tmp PID 2212 wrote to memory of 3340 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe inl9632.tmp PID 2212 wrote to memory of 3340 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe inl9632.tmp PID 2108 wrote to memory of 956 2108 cmd.exe reg.exe PID 2108 wrote to memory of 956 2108 cmd.exe reg.exe PID 2108 wrote to memory of 956 2108 cmd.exe reg.exe PID 2212 wrote to memory of 4656 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2212 wrote to memory of 4656 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2212 wrote to memory of 4656 2212 0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe cmd.exe PID 2108 wrote to memory of 1548 2108 cmd.exe reg.exe PID 2108 wrote to memory of 1548 2108 cmd.exe reg.exe PID 2108 wrote to memory of 1548 2108 cmd.exe reg.exe PID 2108 wrote to memory of 1524 2108 cmd.exe attrib.exe PID 2108 wrote to memory of 1524 2108 cmd.exe attrib.exe PID 2108 wrote to memory of 1524 2108 cmd.exe attrib.exe PID 2108 wrote to memory of 4004 2108 cmd.exe attrib.exe PID 2108 wrote to memory of 4004 2108 cmd.exe attrib.exe PID 2108 wrote to memory of 4004 2108 cmd.exe attrib.exe PID 2108 wrote to memory of 1720 2108 cmd.exe rundll32.exe PID 2108 wrote to memory of 1720 2108 cmd.exe rundll32.exe PID 2108 wrote to memory of 1720 2108 cmd.exe rundll32.exe PID 2108 wrote to memory of 1356 2108 cmd.exe rundll32.exe PID 2108 wrote to memory of 1356 2108 cmd.exe rundll32.exe PID 2108 wrote to memory of 1356 2108 cmd.exe rundll32.exe PID 1720 wrote to memory of 2772 1720 rundll32.exe runonce.exe PID 1720 wrote to memory of 2772 1720 rundll32.exe runonce.exe PID 1720 wrote to memory of 2772 1720 rundll32.exe runonce.exe PID 2772 wrote to memory of 4696 2772 runonce.exe grpconv.exe PID 2772 wrote to memory of 4696 2772 runonce.exe grpconv.exe PID 2772 wrote to memory of 4696 2772 runonce.exe grpconv.exe PID 3340 wrote to memory of 1744 3340 inl9632.tmp cmd.exe PID 3340 wrote to memory of 1744 3340 inl9632.tmp cmd.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1524 attrib.exe 4004 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_212.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /c C:\Users\Admin\AppData\Roaming\PIPI\pwdedit.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\PROGRA~1\INTERN~1\iexplore.exeC:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWW.cnkankan.com/?821334⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4304 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4704 -
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\1.inf4⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\2.bat4⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?n"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1928 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?n"" /f5⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4192 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?n"" /f5⤵PID:4692
-
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f5⤵
- Modifies registry class
PID:956 -
C:\Windows\SysWOW64\reg.exereg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\datread\3.bat""" /f5⤵
- Modifies registry class
PID:1548 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1524 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4004 -
C:\Windows\SysWOW64\rundll32.exerundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\2.inf5⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:4696
-
C:\Windows\SysWOW64\rundll32.exerundll32 D:\VolumeDH\inj.dat,MainLoad5⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\inl9632.tmpC:\Users\Admin\AppData\Local\Temp\inl9632.tmp2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl9632.tmp > nul3⤵PID:1744
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0411FB~1.EXE > nul2⤵PID:4656
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5a20dcdd581a69f44e7dcbeeab5084fb4
SHA161e152b89ab8a04af1843bbfee557d193924ec51
SHA256009768e52ded8da33ac7d96d521e882eef9765278997f2ce47311f637696d9c7
SHA51277de84bf9c5480e704991bc16d8f555dc10891e3a5a7044fe2b133cc49d20ebb78c68bbdd4c9a4acd8e7424bce28a00bd3651f3b852a2a726f3f879a741cc7ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD54183511f7d29c327554ca842efdaa95a
SHA164aa116f0dd3be496d12cd7f9b34d976e6b16ac9
SHA25671b81fc01d22bcbd6690d59380be0e67319f0effeddbd0e5d29c198681a5376c
SHA51236240143646f6836658c33c52103dd943b42f0f3c0de36741adbc4b61e8a407353741081950fc0f4c3dabfbb901a2e10aeca362bc58ca8b1a8f1455aeab38eaa
-
Filesize
803B
MD59a56669fda653d180272060c91a1e932
SHA1d5fd0bd68300df626aaad370ad96912f2edd3cf6
SHA25637aa151bf0fc859681e856a3dad384f2344b542546e71d080ed7ac31abd79ac8
SHA512e6a81e5e02a49a744ab62505d3d765a44f246c572f10b032a8e8137aba8b3f0c930ae8f5790c7104c0d1b4bfb9d5282363479954339758f932811260106ae6e1
-
Filesize
794B
MD51bc415b31cdff50d79ea2a3d7b4ff2c1
SHA1f5ebab61deebc3d7a4a6676a23b982f1418ae6a6
SHA256582ea6421c80adc1de2dcb34fb8db1926e34b49219d99306693166a6b268d412
SHA512ee9718e829fa7c6b2e3b208fe99acd390d704a4ad037fd9b5ae231db184f48146792fb1ac028a69224ddca2c3195ef2aa5353ee6bc7abe01157773f4a6e50e84
-
Filesize
858B
MD5d727e34e3f5eb5ee1ce17fe4c66bf617
SHA1ea796e8b305510775d244f30758e125a01569626
SHA256d0cd1c2b674ee72b000ecacb181addd7735f4c3478731c23f4649e312e4c607d
SHA512ae3028364bf02b3e7c78d7a44a3305537c16d7feefb9dd968296b86425babaccee81af0c40eb7f8f374266df0e2c3c1a08b6b951ceaddc55572d6f0f1e85705c
-
Filesize
54B
MD55dd457b845e53fce36e6b543764337e4
SHA1eb7f8ce82274afa5702b20eb5ba133bb71bcb8d6
SHA2560a2c605c32f2e9b3eda6f18df3d8c1fc2d87922b9bb23d6c3a9de3aa3f383992
SHA5120fea97ddf333c178ca4805fc85f8b66f81a7906d1cc7bf440206aff50cc711643e90115f046077a323b3cc78deeb704f7eb8a934d0a1cd011f6a3ad67057c9f6
-
Filesize
62B
MD5f33f30c3cddbb32ce1641f7aa325a170
SHA1dcaa649892d9acf11658bb7b85ae63b76d36a4a8
SHA256efc90ad2a6161fb21977815aeb81095e82572a40a2b3ab69cd1abad04c6bc23d
SHA512d07d64eaf8cee948de2099fc791f79a5b6a58529c760bd3f3105d2689708930026a54b3b27c0e55bbf4b3356ff9c8bd915704e80af7735a865bcf4a9abcadf79
-
Filesize
5.8MB
MD5a2d0b95eecec0b13e4b2d111223feca8
SHA1a63fc5419566a870d8bcb2a4c9c8423bbbac9633
SHA256aae54e202188e015109535d4c670b9bf0a4e0c67d8f7582347683c47fe991ac9
SHA512dc766c5b6496cb449f82d07e68a04804dd52aed9c78b374d1c7bca3bce5d28fe99f9274f814aacd9a4ddf6323954b7fe60a8d8747452cbb7afef2bcc878a5fe9
-
Filesize
3KB
MD5e580af507ea9f91de910e0c11b1e5ff1
SHA1998ed9fad171139fca6e0da98f660417fb87fc1c
SHA2567ab3f848e819dbfe653558a517b6bcd0274040d4e5a0a74e1556916aa5f9d356
SHA512240d3ed95def600a7b6da7b4ec9f0d2289471d7c96c8bff7198b33d55671004e3b7ad500935d9bd8b7d1cc08ad648b05f1b21c4e958542ac6a150dc3dd4797ab
-
Filesize
410B
MD566a1f0147fed7ddd19e9bb7ff93705c5
SHA19d803c81ea2195617379b880b227892ba30b0bf6
SHA2564f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764
SHA512cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597
-
Filesize
3KB
MD57c54db0864c2eb965c63c3dfe6be2256
SHA1303c5edaa7ec4530f88484e3c48ff7e674a676d1
SHA2561886e568662fcc552a91c3ab25b86e5243032d4f43fa45ffb51c57ca533c4b91
SHA51260677e5762c2a267269ca520f554b800e88ce80bd96479b0ab02ea9eded76332657c3c9b93961c47551bdea3feda4b1dd88e58ebd087ae42a7853fd4bf0b8997
-
Filesize
248B
MD5c5eaacddf7fe93d130f1eb67f3fc2d9d
SHA1ce20a3a2d9925fa4672884ffda2ee200c06ad7ce
SHA256c740a578ef5867e18bc914ef724c8258a324b4f35591690e91329a10d17f6b45
SHA5121f9529123cf74f1c53f75d81b9b6dabb127fcef0067c104c5ca044e28450083fa379c256d63d07d4e4053f197c24e02f9e2ab4507f8bb1068032598b52bbbf77
-
Filesize
5.8MB
MD52cf4a3654b953935b844502c52715ee5
SHA1b1c2b34458f8230336a943928a2f1919216855bd
SHA256c085020d2e90f29b1d3192419f55fd8297181a09d32ad4bc042ea84ebfa4d9b3
SHA512e563b71109228832f9260d6af9e6b837e2ec040ab9230a25fde54a347b619587da49ebda592bcf7d4f578185301a5c3ae4af37417312fad1ce7d304b2bc8036b