Overview
overview
7Static
static
7041da292d8...18.exe
windows7-x64
7041da292d8...18.exe
windows10-2004-x64
7$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3EasyOn.dll
windows7-x64
6EasyOn.dll
windows10-2004-x64
6EasyOn.exe
windows7-x64
6EasyOn.exe
windows10-2004-x64
6Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 07:42
Behavioral task
behavioral1
Sample
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
EasyOn.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
EasyOn.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
EasyOn.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
EasyOn.exe
Resource
win10v2004-20240508-en
General
-
Target
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe
-
Size
262KB
-
MD5
041da292d8c81aa4f26fb43b88c8af19
-
SHA1
5811aade51661c173b64bf3d6f427cf5b86421bd
-
SHA256
594c265b6428c4d72d73345a064154207e51e65bfe0e525cd796d01c2456b418
-
SHA512
c5adf994f9a6c612eb8bb621acc826ca10aa391b889b38329eb009494679c9a8a128ae8d970d7d29cc47da5aa66eac91ae595baf5834dd9ba455840756bda52d
-
SSDEEP
6144:de346iT75+ZPPfnE2Qyn20UATyniR1E2OGPCXiu75+ZPPfnE2Qyn20U:eiTF+ZPPfnEUnPTKiUhGaiuF+ZPPfnEG
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nst2222.tmp\SelfDel.dll acprotect -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 2424 explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
EasyOn.exepid process 2524 EasyOn.exe -
Loads dropped DLL 9 IoCs
Processes:
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exeregsvr32.exeregsvr32.exepid process 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 1036 regsvr32.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2828 regsvr32.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nst2222.tmp\SelfDel.dll upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
EasyOn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EasyOn = "C:\\Program Files (x86)\\EasyOn\\EasyOn.exe" EasyOn.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exedescription pid process target process PID 2924 set thread context of 2424 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe explorer.exe -
Drops file in Program Files directory 4 IoCs
Processes:
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\EasyOn\EasyOn.dll 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe File created C:\Program Files (x86)\EasyOn\EasyOn.exe 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe File created C:\Program Files (x86)\EasyOn\Uninstall.exe 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe File created C:\Program Files (x86)\EasyOn\1 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\TabProcGrowth = "0" regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\ = "IBandHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\VersionIndependentProgID\ = "EasyOn.SideBand" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper.1\ = "BandHelper Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\0 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper\ = "BandHelper Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\ = "SideBand Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CurVer\ = "EasyOn.SideBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CLSID\ = "{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ = "EasyOn" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\0\win32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ = "EasyOn" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\TypeLib\ = "{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\Implemented Categories regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\VersionIndependentProgID\ = "EasyOn.BandHelper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper\CurVer\ = "EasyOn.BandHelper.1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper\CLSID\ = "{1CE681DC-1190-40EF-85A9-ADE47098CF51}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B32ACA33-EA72-4757-A8CF-EFAE06B218EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\ = "EasyOnHelper" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\ = "SideBand Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ = "ISideBand" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID\ = "EasyOn.SideBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32}\1.0\ = "EasyOn 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ = "ISideBand" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5740EFD7-04A6-4FEB-AA0F-E5F2BA962DB0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\InprocServer32\ = "C:\\Program Files (x86)\\EasyOn\\EasyOn.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper.1\ = "BandHelper Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.BandHelper\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9EC01A8D-1377-4F63-89D8-AE6CD3E43C32} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51A6FBA6-21E1-44B9-8998-5E886EB3E74F}\ProgID\ = "EasyOn.SideBand.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CE681DC-1190-40EF-85A9-ADE47098CF51}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EasyOn.SideBand\CurVer\ = "EasyOn.SideBand.1" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exepid process 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
EasyOn.exepid process 2524 EasyOn.exe 2524 EasyOn.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exeEasyOn.exedescription pid process target process PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 1036 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe regsvr32.exe PID 2924 wrote to memory of 2524 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe EasyOn.exe PID 2924 wrote to memory of 2524 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe EasyOn.exe PID 2924 wrote to memory of 2524 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe EasyOn.exe PID 2924 wrote to memory of 2524 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe EasyOn.exe PID 2924 wrote to memory of 2424 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2424 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2424 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2424 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe explorer.exe PID 2924 wrote to memory of 2424 2924 041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe explorer.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe PID 2524 wrote to memory of 2828 2524 EasyOn.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\041da292d8c81aa4f26fb43b88c8af19_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\EasyOn\EasyOn.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1036 -
C:\Program Files (x86)\EasyOn\EasyOn.exe"C:\Program Files (x86)\EasyOn\EasyOn.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\EasyOn\EasyOn.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2828 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\system32\explorer.exe2⤵
- Deletes itself
PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5b8d58e3a0587f0015e5ef6e611444f30
SHA1181d12bc03b329f4ddd4f85f792b2f0a7b9d147a
SHA25641321b02a4922ab9911e340c190eead9e17d5f56590921953b0658958e1bfba8
SHA512b2e1c3f4ec7e1f468fd8e4d190a17268f2008dfc8e8a68e45b6a109cb98322c5363d49d5aaf8e76cf38c7fc1e813179f776dd90ad6ae55b6b46ddbafe1b56434
-
Filesize
38KB
MD5e95bc409a64ea9a611bf6df227eb7e3c
SHA19388530cf6d248c1c73cee05a2d66c77a1cbcac4
SHA2569bf1cea5efcecb3dd7f28c3d6359037807b3379aeb82f154c27e1f84c3286f3a
SHA512a5220d93b3c94d158e33b8d01fa2dc18dbf029ebd70871351b3b1c0fa6225d42e419122ecc0d0a12abecd3d42a90ab87793f239c21c63afcf05d6b2e10bc550e
-
Filesize
114KB
MD5a3ed6f7ea493b9644125d494fbf9a1e6
SHA1ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA256ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
SHA5127099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
4KB
MD57cff7fe2caea5184d98c147e7e263132
SHA121f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA256281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
SHA512fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
-
Filesize
13KB
MD529858669d7da388d1e62b4fd5337af12
SHA1756b94898429a9025a04ae227f060952f1149a5f
SHA256c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
SHA5126f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b