Analysis
- max time kernel
154s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/06/2024, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1427be78ce89202529007acc1b12ab33_JaffaCakes118.dll
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
General
- Target 1427be78ce89202529007acc1b12ab33_JaffaCakes118.dll
- Size 696KB
- Sample240627-bl2dksvbqe
- SHA256 26448ca7e95253c08afe44086fdc93a94278dc4890847c3452e6c4064c5345ad
- MD5 1427be78ce89202529007acc1b12ab33
- SHA1 6297946c1b570ddbf3d2a9c55d09e6f8fadf1c57
- SHA512 1a9f185a63db93c76c2900071fb48830528650065836e18b0fe6ce7cf436a274a1299f8e1057fa52ef4ed93e09097cdd5fcf72fc372bac762949c48da71834cd
- SSDEEP 12288:/C+yvYvpOdFnwEhhqHDkjPq9Lgo9dR9mjCmyvpoTExqzz5CxH1v7d2U7O8ZxwytD:/CDvYZEhhqjkji9Lgo9/9mjCmyvpoTEB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation regsvr32mgr.exe - Executes dropped EXE 2 IoCs
pid Process 2680 regsvr32mgr.exe 4396 imrhroiglmbikxiq.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 2168 2656 WerFault.exe 95 4312 1692 WerFault.exe 105 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2993498317" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2993498317" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E7753293-3422-11EF-B9F7-D6C6679D10A6} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115311" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115311" IEXPLORE.EXE - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229B78B8-38F5-11D5-9001-00C04F4C3B9F}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78CD-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78BB-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C9-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78d5-38f5-11d5-9001-00c04f4c3b9f}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78e1-38f5-11d5-9001-00c04f4c3b9f}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78BA-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78C6-38F5-11D5-9001-00C04F4C3B9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78e0-38f5-11d5-9001-00c04f4c3b9f}\VersionIndependentProgID\ = "CDDBControlAOL.CddbURL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229B78B8-38F5-11D5-9001-00C04F4C3B9F}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78d5-38f5-11d5-9001-00c04f4c3b9f}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C6-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\ = "{229B78B8-38F5-11D5-9001-00C04F4C3B9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C2-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78BA-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbID3TagManager\ = "CddbID3TagManager Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78BF-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c7-3909-11d5-9001-00c04f4c3b9f} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78CA-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78B3-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\ = "{229B78B8-38F5-11D5-9001-00C04F4C3B9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78B4-38F5-11D5-9001-00C04F4C3B9F}\ = "ICddbTracks" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c5-3909-11d5-9001-00c04f4c3b9f} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78C9-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229B78B8-38F5-11D5-9001-00C04F4C3B9F}\1.0\ = "CDDBControl(AOL) 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c4-3909-11d5-9001-00c04f4c3b9f}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c5-3909-11d5-9001-00c04f4c3b9f}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78B0-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78B0-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78D1-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c8-3909-11d5-9001-00c04f4c3b9f} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78B2-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78CF-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CDDBAOLControl.1\ = "CDDBAOLControl Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78d5-38f5-11d5-9001-00c04f4c3b9f} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78CA-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78CA-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C4-38F5-11D5-9001-00C04F4C3B9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78B2-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\ = "{229B78B8-38F5-11D5-9001-00C04F4C3B9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78B7-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\ = "{229B78B8-38F5-11D5-9001-00C04F4C3B9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControl.CddbTrackManager.1\CLSID\ = "{00014C0D-B007-4448-B89B-4EC3E857961D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c8-3909-11d5-9001-00c04f4c3b9f}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbID3TagManager.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78CE-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\ = "{229B78B8-38F5-11D5-9001-00C04F4C3B9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbDisc\ = "CddbDisc Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbURLManager.1\ = "CddbURLManager Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78d5-38f5-11d5-9001-00c04f4c3b9f}\VersionIndependentProgID\ = "CDDBControlAOL.CddbDisc" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78C5-38F5-11D5-9001-00C04F4C3B9F}\ = "ICddbURLTree" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C7-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78BC-38F5-11D5-9001-00C04F4C3B9F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbDisc.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78df-38f5-11d5-9001-00c04f4c3b9f}\TypeLib\ = "{229b78b8-38f5-11d5-9001-00c04f4c3b9f}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78C0-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\ = "{229B78B8-38F5-11D5-9001-00C04F4C3B9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78BD-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78B9-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c5-3909-11d5-9001-00c04f4c3b9f}\TypeLib\ = "{229b78b8-38f5-11d5-9001-00c04f4c3b9f}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc8a96c6-3909-11d5-9001-00c04f4c3b9f}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229B78B8-38F5-11D5-9001-00C04F4C3B9F}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78B3-38F5-11D5-9001-00C04F4C3B9F}\ = "ICddbDisc" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78CA-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C8-38F5-11D5-9001-00C04F4C3B9F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbID3TagManager.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{229B78CF-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{229b78d5-38f5-11d5-9001-00c04f4c3b9f}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlAOL.CddbInfoWindow.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{229B78C7-38F5-11D5-9001-00C04F4C3B9F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 672 Process not Found - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2680 regsvr32mgr.exe Token: SeDebugPrivilege 2680 regsvr32mgr.exe Token: SeSecurityPrivilege 4396 imrhroiglmbikxiq.exe Token: SeLoadDriverPrivilege 4396 imrhroiglmbikxiq.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1124 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1124 IEXPLORE.EXE 1124 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 568 wrote to memory of 3796 568 regsvr32.exe 90 PID 568 wrote to memory of 3796 568 regsvr32.exe 90 PID 568 wrote to memory of 3796 568 regsvr32.exe 90 PID 3796 wrote to memory of 2680 3796 regsvr32.exe 94 PID 3796 wrote to memory of 2680 3796 regsvr32.exe 94 PID 3796 wrote to memory of 2680 3796 regsvr32.exe 94 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 2656 2680 regsvr32mgr.exe 95 PID 2680 wrote to memory of 1136 2680 regsvr32mgr.exe 100 PID 2680 wrote to memory of 1136 2680 regsvr32mgr.exe 100 PID 2680 wrote to memory of 1136 2680 regsvr32mgr.exe 100 PID 1136 wrote to memory of 1124 1136 iexplore.exe 101 PID 1136 wrote to memory of 1124 1136 iexplore.exe 101 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 1692 2680 regsvr32mgr.exe 105 PID 2680 wrote to memory of 4480 2680 regsvr32mgr.exe 111 PID 2680 wrote to memory of 4480 2680 regsvr32mgr.exe 111 PID 2680 wrote to memory of 4480 2680 regsvr32mgr.exe 111 PID 4480 wrote to memory of 2144 4480 iexplore.exe 112 PID 4480 wrote to memory of 2144 4480 iexplore.exe 112 PID 1124 wrote to memory of 1388 1124 IEXPLORE.EXE 113 PID 1124 wrote to memory of 1388 1124 IEXPLORE.EXE 113 PID 1124 wrote to memory of 1388 1124 IEXPLORE.EXE 113 PID 2680 wrote to memory of 4396 2680 regsvr32mgr.exe 114 PID 2680 wrote to memory of 4396 2680 regsvr32mgr.exe 114 PID 2680 wrote to memory of 4396 2680 regsvr32mgr.exe 114
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1427be78ce89202529007acc1b12ab33_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1427be78ce89202529007acc1b12ab33_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:2656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 2045⤵
- Program crash
PID:2168
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1388
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2045⤵
- Program crash
PID:4312
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
PID:2144
-
-
-
C:\Users\Admin\AppData\Local\Temp\imrhroiglmbikxiq.exe"C:\Users\Admin\AppData\Local\Temp\imrhroiglmbikxiq.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2656 -ip 26561⤵PID:552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1692 -ip 16921⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\regsvr32mgr.exe
- Size 110KB
- SHA256 f5204dc271e72770b75fff3703d4c3f48011807a21816a8b2f82efe69ab28626
- MD5 a06539e080f0796c507ea485effbc8b0
- SHA1 c31d586000b50ec398b1e1dcfecbc31382449db4
- SHA512 30c4250ccdf2a5df73688285253f9f476da9f9d6517539e6db951c8cd3de9819b2fa040093fc36d24aaf0a5e23c78abfce1cb693c21bcfb3ab9e4fd0385e1b59
- SSDEEP 3072:39y2beY8m+1GYPHMiqqOIx4J2vNbGfvGnd3gW5ZM4/ue/1:3hX8mKGmHKGNdndPZMTe/1
- MD5 SHA1 SHA512 SSDEEP