4501c4f93e2c23e89eb7775321b58d25313bec343713d09ab432111f95a9b78a

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Size

222KB
MD5

81c1916faaf4854ca8b533468c48c811
SHA1

655ffb2eb26dfcf2db8e765c3ad68c0353f75a8b
SHA256

4501c4f93e2c23e89eb7775321b58d25313bec343713d09ab432111f95a9b78a
SHA512

2c413c511c6e7de54673bbd9776bc8eb3625ee9592579232238f754a3244fd52ea155a62eff3851e12d43b52b510b9b3026a1b2c1cdd873c1e54bb8ade62e31c
SSDEEP

6144:Ku3dwQ0I23Pvq8AS10fsiGodZTfq/kX1XtHNdBbqcVO:DNQqnS1GsiGod1fNhtHNuL

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\id = "bdbar"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Progra~1\Baidu\bar\SETA737.tmp	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
File created	C:\Progra~1\Baidu\bar\SETA737.tmp	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
File opened for modification	C:\Progra~1\Baidu\bar\BaiDuBar.dll	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUSEARCH.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUNEWS.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Í¼Æ¬\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUIMG.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Í¼Æ¬\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDULYRIC.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUPOST.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 00	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUMP3.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDU_DIC.HTM"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³\Contexts = 10	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Í¼Æ¬	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu\CurVer	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\VersionIndependentProgID\ = "BaiduBar.Tool"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter\CurVer\ = "MimeFilter.AdFilter.1"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CLSID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget.1\CLSID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE\CurVer	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\ = "Tool Class"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\VersionIndependentProgID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib\Version = "1.0"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\ProgID\ = "BaiduBar.Tool.1"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\VersionIndependentProgID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1\ = "BandIE Class"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib\Version = "1.0"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\CLSID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE\CurVer\ = "BaiduBarEx.BandIE.1"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\TypeLib	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu.1\CLSID\ = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\VersionIndependentProgID\ = "BaiduBar.Baidu"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1\CLSID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget.1\ = "DropTarget Class"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\ = "BaiduBarEx 1.0 Type Library"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\HELPDIR	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\VersionIndependentProgID\ = "MimeFilter.AdFilter"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\Programmable	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\TypeLib	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\InprocServer32\ThreadingModel = "Apartment"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ = "IBandIE"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32\ThreadingModel = "Apartment"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\ = "Tool Class"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\Programmable	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget\CLSID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1\CLSID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\TypeLib\Version = "1.0"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ = "IAdFilter"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\CLSID\ = "{A7F05EE4-0426-454F-8013-C41E3596E9E9}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\ProgID\ = "MimeFilter.AdFilter.1"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\ = "DropTarget Class"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ProxyStubClsid32	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\TypeLib	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\ProgID	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\FLAGS\ = "0"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ProxyStubClsid32	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ProxyStubClsid32	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter\CLSID\ = "{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}"	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeRestorePrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Token: SeBackupPrivilege	1656	81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BaiduBar.dll

Filesize
286KB

MD5
e4bc62a44704db1e93d4e839781d1920

SHA1
1e9dcd259beff683a81432bf2539b047700a2f9a

SHA256
e58dfa77619ef7d60c9f7ef40db74a81643ecf1886d1960be65578b18183b318

SHA512
3bbc9e0745406863c27e9cb98bdd403b192840d905a9bba9bb02e86581d16805292c197c8a79ae6ee2f22c1ddc50f763b6e4ae95d21a9055b94abeb17ccdef04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.inf

Filesize
588B

MD5
886a3c4174f4f95b51092a0cfeeb822c

SHA1
eaf1332f2f03e8cafc7ee5dc211ac8e6faa3d3d1

SHA256
228478419fbad9a1d37da2d06a1bdda885ddb0bc9bbb537fa7911abcde71f5f3

SHA512
ea882630d1f2cd8e80db3283a30e301b05ac1561fd70a3c4bd623be368e31c009692635c91a4fd5ca3d7833354605fef64222acecbccc964ad449a2a44315920

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
90KB

MD5
d553b62a8136d41289513c6405efea2d

SHA1
db48c3fd3993ff20511e47ffad14bfbdb9f438eb

SHA256
ce7cfb626807084186b248bbf2ef776eac086da936146f7d44956c2fcfaec1f8

SHA512
4a3767e8ac1e684a9a6eaced921b9599e34d5a4e83f034c7fe42bd8fd707a2b86f51ad485933fed5015554c3f9c4cf4b1357832964cc170d8cba86092fc9d2e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads