Analysis
- max time kernel
82s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/06/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14b4924873f6d423b61af3323b9a1636_JaffaCakes118.dll
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
General
- Target 14b4924873f6d423b61af3323b9a1636_JaffaCakes118.dll
- Size 368KB
- Sample240627-e8qr5ssfke
- SHA256 9c63603befe22355c1a32460abf30a4ca9c3074ad3d8a0e0d55ae673eee1c56d
- MD5 14b4924873f6d423b61af3323b9a1636
- SHA1 529461267f1b59d2b8decde33a11da00f0a46aed
- SHA512 ad104c41de22c9117b6b3b8c22d1e2226cdab6fc5e9d0587f4494fc0b369651f6837488ef2b2214c3813d0f92a7afe32be9c4cbce829c67f9ec21aef9f307386
- SSDEEP 6144:KD04PlLlVnPyFFbdMOU1yK383NyHUTcj/bfbc5A:KD7lPnP4pXU1yKm40TcHbc2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" regsvr32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" regsvr32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" regsvr32mgr.exe - Executes dropped EXE 2 IoCs
pid Process 392 regsvr32mgr.exe 1472 WaterMark.exe -
resource yara_rule behavioral2/memory/392-26-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/392-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/392-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/392-9-0x0000000004A00000-0x0000000005A8E000-memory.dmp upx behavioral2/memory/392-13-0x0000000004A00000-0x0000000005A8E000-memory.dmp upx behavioral2/memory/392-31-0x0000000004A00000-0x0000000005A8E000-memory.dmp upx behavioral2/memory/392-33-0x00000000031D0000-0x00000000041FA000-memory.dmp upx behavioral2/memory/392-28-0x00000000031D0000-0x00000000041FA000-memory.dmp upx behavioral2/memory/392-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/392-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/392-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/392-6-0x00000000031D0000-0x00000000041FA000-memory.dmp upx behavioral2/memory/392-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1472-45-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1472-51-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1472-57-0x0000000000400000-0x0000000000421000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" regsvr32mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" regsvr32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" regsvr32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" regsvr32mgr.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px4C0D.tmp regsvr32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI regsvr32mgr.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E9CE09A2-343E-11EF-BA70-D64620966489} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425624907" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E9C21E54-343E-11EF-BA70-D64620966489} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14B492~1.DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\TypeLib\ = "{AE1250CD-F527-4B55-BE4A-5CC211216C49}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RtlCP.RtlCP.1\ = "RtlCP Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RtlCP.RtlCP\CurVer\ = "RtlCP.RtlCP.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14b4924873f6d423b61af3323b9a1636_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\ = "IRtlCP" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\ = "IRtlCP110" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\ = "IRtlCP111" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\VersionIndependentProgID\ = "RtlCP.RtlCP" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\ = "IRtlCP114" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\TypeLib\ = "{AE1250CD-F527-4B55-BE4A-5CC211216C49}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\TypeLib\ = "{AE1250CD-F527-4B55-BE4A-5CC211216C49}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RtlCP.RtlCP\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\ = "IRtlCP" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\ = "IRtlCP111" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RtlCP.RtlCP.1\CLSID\ = "{E9F1F599-7B14-4213-BF46-F992758CAB81}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\ProgID\ = "RtlCP.RtlCP.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\ = "RtlCPAPI 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\ = "IRtlCP114" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\TypeLib\ = "{AE1250CD-F527-4B55-BE4A-5CC211216C49}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RtlCP.RtlCP.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RtlCP.RtlCP.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B8F5B4C2-444B-474C-B795-134A5D0239FB}\ = "IRtlCP110" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\TypeLib\ = "{AE1250CD-F527-4B55-BE4A-5CC211216C49}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE1250CD-F527-4B55-BE4A-5CC211216C49}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA1F512C-85D2-4A68-9DC9-BD3B10E625BA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\ = "RtlCP Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9F1F599-7B14-4213-BF46-F992758CAB81}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A24F60F4-39B8-461D-9DDB-DF42E7225ED7}\TypeLib\ = "{AE1250CD-F527-4B55-BE4A-5CC211216C49}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68C93223-1B9E-4BBC-9F32-AD4928C0ECAB} regsvr32.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 392 regsvr32mgr.exe 392 regsvr32mgr.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe 1472 WaterMark.exe - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 392 regsvr32mgr.exe Token: SeDebugPrivilege 1472 WaterMark.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2152 iexplore.exe 4488 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4488 iexplore.exe 4488 iexplore.exe 2152 iexplore.exe 2152 iexplore.exe 952 IEXPLORE.EXE 952 IEXPLORE.EXE 756 IEXPLORE.EXE 756 IEXPLORE.EXE 952 IEXPLORE.EXE 952 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 392 regsvr32mgr.exe 1472 WaterMark.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4624 wrote to memory of 1408 4624 regsvr32.exe 81 PID 4624 wrote to memory of 1408 4624 regsvr32.exe 81 PID 4624 wrote to memory of 1408 4624 regsvr32.exe 81 PID 1408 wrote to memory of 392 1408 regsvr32.exe 82 PID 1408 wrote to memory of 392 1408 regsvr32.exe 82 PID 1408 wrote to memory of 392 1408 regsvr32.exe 82 PID 392 wrote to memory of 784 392 regsvr32mgr.exe 9 PID 392 wrote to memory of 792 392 regsvr32mgr.exe 10 PID 392 wrote to memory of 316 392 regsvr32mgr.exe 13 PID 392 wrote to memory of 2712 392 regsvr32mgr.exe 49 PID 392 wrote to memory of 2756 392 regsvr32mgr.exe 50 PID 392 wrote to memory of 2988 392 regsvr32mgr.exe 51 PID 392 wrote to memory of 3408 392 regsvr32mgr.exe 55 PID 392 wrote to memory of 3628 392 regsvr32mgr.exe 57 PID 392 wrote to memory of 1472 392 regsvr32mgr.exe 83 PID 392 wrote to memory of 1472 392 regsvr32mgr.exe 83 PID 392 wrote to memory of 1472 392 regsvr32mgr.exe 83 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 1724 1472 WaterMark.exe 84 PID 1472 wrote to memory of 4488 1472 WaterMark.exe 85 PID 1472 wrote to memory of 4488 1472 WaterMark.exe 85 PID 1472 wrote to memory of 2152 1472 WaterMark.exe 86 PID 1472 wrote to memory of 2152 1472 WaterMark.exe 86 PID 4488 wrote to memory of 756 4488 iexplore.exe 87 PID 4488 wrote to memory of 756 4488 iexplore.exe 87 PID 4488 wrote to memory of 756 4488 iexplore.exe 87 PID 2152 wrote to memory of 952 2152 iexplore.exe 88 PID 2152 wrote to memory of 952 2152 iexplore.exe 88 PID 2152 wrote to memory of 952 2152 iexplore.exe 88 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" regsvr32mgr.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2756
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2988
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14b4924873f6d423b61af3323b9a1636_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\14b4924873f6d423b61af3323b9a1636_JaffaCakes118.dll3⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:392 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵PID:1724
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4488 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:756
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:952
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E9C21E54-343E-11EF-BA70-D64620966489}.dat
- Size 3KB
- SHA256 43fa73d89bb3df8f5a057f9669cc69903d01da698617ae9f4105b02ef877a9e6
- MD5 63001f16a744d612d193556e568820fa
- SHA1 3c1db77e3c947b6e52c19a0a39c899f293e299c0
- SHA512 67e3043c6b697c6b1861c72dbdaf180609bdd2bc2f87442568f09347fff43cc0b2dcfe8258dbecab8b301a61061e9969a979dff96dfce10eb582a03d74d413f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E9CE09A2-343E-11EF-BA70-D64620966489}.dat
- Size 5KB
- SHA256 5d3b76c9bbf3e690243e229881395ec2773fecc24fbc48659154b1f5755690a0
- MD5 f1db09dc1e394ebe079ebd90b2ffa406
- SHA1 923deefd62fa170c4f0ca8b019beeb1e1b5ed228
- SHA512 c8414bf4314170965ce689bce53fcc57dc9a4de5b5dc36a5b8f553e2fee9ea67e193728f5e442ed97e40352fbcf15b0871e7cf5095b46052b1b9cab21dbecf42
- SSDEEP 24:r/Go/QHjG1ybGo/rjG1yyjG1y879lWAqD9lWAq:r/Go4HoAGoDoPoVCAHA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\regsvr32mgr.exe
- Size 220KB
- SHA256 924f71fc160eaefbcbdcdbdc4e7bb5fc83a91ac9fa583c1e547045095b4676ee
- MD5 65762695e3d3887ace6f27334011108a
- SHA1 4d9f00597e6f593e8d5cceff3401d680ead151de
- SHA512 388a04ba42cbb1204c62d62747748630b4d1aeb0b00d64fcd31e5823f79e07c184a80de15e6e0418a218447505156f293110da870190b9bd51b2f9d724e3edc2
- SSDEEP 3072:8nxwgxgfR/DVG7wBpEcqAS/YtFiY4KPbfJ1wVwk4atC8w4EE2K/z8+5csK8:A+xDVG0BpUATo+bfM54a5QEpv
- MD5 SHA1 SHA512 SSDEEP