Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 14:06
Behavioral task
behavioral1
Sample
2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
15 signatures
150 seconds
General
-
Target
2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe
-
Size
72KB
-
MD5
2ca3014e26b5cdbb4d3dbafd4a813640
-
SHA1
253aa9f7b630fe94e40dc66abf52cb0774b12a7d
-
SHA256
9ee2cd6500b34005f3a325b767f40ff13cc89d733f705b1a313a12bb8fad251a
-
SHA512
b892010dc675c971cead07d5b000face6e2311f15a26af46ac61deded76c01758878dcd3c9a0c3cb63ca76c98ad9f9c049aabc0d77d7e6edf60b3639a67a8fb1
-
SSDEEP
1536:hBkfZtbajYeRX8FHyaiIImPrxsa7yreeH92PMKFusz4M20/m:0Rda0eRMFHyaietT7oeuKF92
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00080000000235d5-2.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/656-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235d5-2.dat upx behavioral2/memory/656-6-0x0000000010000000-0x0000000010021000-memory.dmp upx behavioral2/memory/656-45-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Applications\myp.ico 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\myv.ico 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\iebu.exe 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\iebr.dll 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\ts.ico 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\ot.ico 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\myd.ico 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe File created C:\Program Files (x86)\Applications\mym.ico 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8FFD251A-3D78-11EF-BCE7-E262BE540013} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31117701" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117701" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427242324" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31117701" iexplore.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{144A6B24-0EBC-4D89-BF09-A06A718E57B5} = 00 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\New Windows\Allow 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1683044920" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1683044920" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1687263736" IEXPLORE.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range16\:Range = "79.143.178.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range19\:Range = "72.21.53.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range7\:Range = "66.235.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range11 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range13\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range20 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range29\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range2\:Range = "195.225.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range9\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range4\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range5\:Range = "216.239.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range13\:Range = "82.179.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range22 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range27\:Range = "78.129.208.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range0\:Range = "194.187.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range20\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range24\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range9 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range5 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range18\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range20\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range22\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range25\:Range = "64.202.189.170" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range4 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range15 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range20\:Range = "195.93.218.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range24\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range28 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range13 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range22\:Range = "78.129.166.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10\:Range = "70.84.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range14\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range14 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range18\:Range = "213.189.27.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range21 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range24\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range25\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range26 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range11\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range9\:Range = "69.50.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range23\:Range = "78.129.158.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range16\:Range = "79.143.178.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range12 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range = "69.31.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range11\:Range = "81.9.3.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range26\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range21 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range23 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range24 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range15\:Range = "202.71.102.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range11\:Range = "81.9.3.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range15\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range22\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range0\:Range = "194.187.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10\:Range = "70.84.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range0\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range5 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range0\:Range = "194.187.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range28\:Range = "91.203.70.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range11\:Range = "81.9.3.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range13 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range20\:Range = "195.93.218.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range26 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range16\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range18\:Range = "213.189.27.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range21 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range28 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range8\:Range = "69.31.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range18\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range0\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range14 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range15 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\Implemented Categories 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range4 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range17\:Range = "88.255.74.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\Implemented Categories\{00021493-0000-0000-C000-000000000046} 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range12\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range16\:Range = "79.143.178.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range24\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range25\:Range = "64.202.189.170" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range29\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range5\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range12\:Range = "81.95.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range15\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5} 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range14\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range22 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range29\:Range = "77.92.88.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range27 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range28\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range12 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range26\:Range = "72.36.152.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range27\:Range = "78.129.208.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range5\:Range = "216.239.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range7\:Range = "66.235.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range13\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range22\:Range = "78.129.166.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range24 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range7 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range7\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range17\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\InprocServer32 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range10\:Range = "70.84.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5} 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range6\:Range = "66.230.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range13\:Range = "82.179.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range2\:Range = "195.225.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\:Range = "205.177.*.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range11\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range23\:Range = "78.129.158.*" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range26\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range27\* = "4" 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 832 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 832 iexplore.exe 832 iexplore.exe 1144 IEXPLORE.EXE 1144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 832 wrote to memory of 1144 832 iexplore.exe 94 PID 832 wrote to memory of 1144 832 iexplore.exe 94 PID 832 wrote to memory of 1144 832 iexplore.exe 94 PID 656 wrote to memory of 3088 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 95 PID 656 wrote to memory of 3088 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 95 PID 656 wrote to memory of 3088 656 2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ca3014e26b5cdbb4d3dbafd4a813640_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wewt0.bat" "2⤵PID:3088
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3376
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3904,i,12101950716832706950,8384629015980369538,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:81⤵PID:3096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5fcbc2a30381e82ef802cff4e27cc5ab9
SHA16d0f6d18f2d7df6bd786ecd2b0b94ad035c8ff68
SHA256950e6f73f9ef974a8708d00897ef963af9760420854356e973e063e6af26be5c
SHA5124f628229380a5b8c2a72ff8b8f28039a00f6de3ced013b95565b118e17a36e608445ffd147daeccdcd5d5551ba3d9ef5151e5fffc284d4e1b57d8ffe93b03688
-
Filesize
134B
MD5d0ffed9df9cd68ec850f27e3bbe69bc0
SHA1f8b8eeb6822085a1203a68acf5a5fc266b13b0ff
SHA2564a50d423342059699b501eebb9401c1456eac17e5d1a6b9020aac7d1b3e4ab1f
SHA512e5afdc7f0d1b4117de4c40feb003b061b31e1cf43e610953cb98a92083dc4abad4f0c05775bde116b56d2ce88a69bd357299e7d05010ddac289d9a7eee86ff4e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
302B
MD5c190dc4606fc9400ce93f3c111316d9c
SHA167780e844932938025e59fa3af048c7ec0a7fbda
SHA25649b688f775e994af9582523edd290fc6ddd09edb4ea5b69f7de635411feb00c1
SHA512c416b630aae65ea2bcf3347514db0f5475a7fbe4513bfa170c35a8adff2761ca923ce37f4c23b8c592cec604191da92816d43b28aa750b215ef4f88a28d52078
-
Filesize
134B
MD51a0c0d8d391c9af28d21f8055cd98832
SHA10bac90cec918a6ad28a366d19c2951b49e354086
SHA2565a317bc67f1472e0734564eae5e76da4e7b6b602296152727efa4b30ba1eda0b
SHA512e2014cec8d39265fb8b799159c0a66be9beb9bf66ea59e0d100fadf7d39733d74c2d4615217bcbf8445146b41684b7da43a0903af0514f35c221da4770a301d0