47d833fef41c26d06568b81f9bf52d44066f3df107f039b8c46ad0868193b08f

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Size

660KB
MD5

0e86ad1df0166ebc0cf45194185398ec
SHA1

52e699cd8a702be037fafeedd3556da239b7a29a
SHA256

47d833fef41c26d06568b81f9bf52d44066f3df107f039b8c46ad0868193b08f
SHA512

5321fc7c7d3a56ca04ada09dbeed6a3852855184d443c92d28b8f6f38a5b4d5461a69b7104a704985d4573e13d78dca994bac50e51e6c0f2b262dd38f99210b1
SSDEEP

12288:gbVLe5JVoMWked/97cgQLwkH4lkYh+O4P2Rk0:gbVLeXVoB/97LGryT+OCI

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\pcmedic.ocx	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\pcmedic.ocx	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\TypeLib\ = "{A7BB2563-084B-4731-B261-88A99EB09118}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Version\ = "1.0"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\MiscStatus	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\0\win32\ = "C:\\Windows\\Downloaded Program Files\\pcmedic.ocx"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\ProxyStubClsid32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\InprocServer32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pcmedic.pcmedicX\Clsid\ = "{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\ProgID	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Control\	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Verb\0	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\TypeLib	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\TypeLib\Version = "1.0"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\TypeLib\Version = "1.0"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pcmedic.pcmedicX	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\TypeLib\ = "{A7BB2563-084B-4731-B261-88A99EB09118}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\MiscStatus\1\ = "205201"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Verb	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\ProxyStubClsid32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\TypeLib	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\MiscStatus\1	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\ToolboxBitmap32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\ProgID\ = "pcmedic.pcmedicX"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\InprocServer32\ThreadingModel = "Apartment"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\0\win32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\ProxyStubClsid32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\ = "IpcmedicXEvents"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\pcmedic.ocx,1"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\ = "pcmedic Library"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\ = "IpcmedicX"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\TypeLib	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\ = "pcmedicX Control"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\pcmedic.ocx"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\TypeLib	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Version	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\TypeLib\ = "{A7BB2563-084B-4731-B261-88A99EB09118}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Verb\0\ = "Properties,0,2"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\HELPDIR\ = "C:\\Windows\\Downloaded Program Files\\"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\ = "IpcmedicXEvents"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\TypeLib	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Verb\	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\HELPDIR	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\0	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\FLAGS\ = "2"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7BB2563-084B-4731-B261-88A99EB09118}\1.0\FLAGS	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\TypeLib\ = "{A7BB2563-084B-4731-B261-88A99EB09118}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\TypeLib\Version = "1.0"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\ = "IpcmedicX"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\MiscStatus\ = "0"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\TypeLib\Version = "1.0"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05292A27-30D9-4DED-8612-237D3E5E006D}\TypeLib\ = "{A7BB2563-084B-4731-B261-88A99EB09118}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\ProxyStubClsid32	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2151E5F3-20AC-484D-B2EC-091BB34BB71E}	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pcmedic.pcmedicX\ = "pcmedicX Control"	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pcmedic.pcmedicX\Clsid	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74B786B8-EAB9-4AB1-B9B5-264ED03BA70A}\Control	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
3004	0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e86ad1df0166ebc0cf45194185398ec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
1⤵
PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Downloaded Program Files\pcmedic.ocx

Filesize
631KB

MD5
c91eca8a281378d557f228900d79da3d

SHA1
22852a5ca6c04c56a93d371ccbdbb709a8131cae

SHA256
7daf0324a08f73f963954513801158f39f501a31bea71af3f9c6ac1dc2b116f8

SHA512
8569fa2e3b1f194be6376e206702f2f9ee0914fadcd5443532541476506ebe5033f5a52b898e4ba4ec7ce6ca489d1be4861fcc2240c5843a38d0ed41a50e75bc

Download Submit
memory/3004-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/3004-6-0x0000000002330000-0x00000000023D3000-memory.dmp

Filesize
652KB

Download
memory/3004-14-0x0000000004200000-0x00000000042A3000-memory.dmp

Filesize
652KB

Download
memory/3004-17-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/3004-18-0x0000000004200000-0x00000000042A3000-memory.dmp

Filesize
652KB

Download
memory/3004-20-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads