Analysis
-
max time kernel
0s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 20:44
Static task
static1
Behavioral task
behavioral1
Sample
81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
-
Size
222KB
-
MD5
81c1916faaf4854ca8b533468c48c811
-
SHA1
655ffb2eb26dfcf2db8e765c3ad68c0353f75a8b
-
SHA256
4501c4f93e2c23e89eb7775321b58d25313bec343713d09ab432111f95a9b78a
-
SHA512
2c413c511c6e7de54673bbd9776bc8eb3625ee9592579232238f754a3244fd52ea155a62eff3851e12d43b52b510b9b3026a1b2c1cdd873c1e54bb8ade62e31c
-
SSDEEP
6144:Ku3dwQ0I23Pvq8AS10fsiGodZTfq/kX1XtHNdBbqcVO:DNQqnS1GsiGod1fNhtHNuL
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 548 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe 548 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697} 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}\id = "bdbar" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Progra~1\Baidu\bar\SETC023.tmp 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe File opened for modification C:\Progra~1\Baidu\bar\BaiDuBar.dll 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe File opened for modification C:\Progra~1\Baidu\bar\SETC023.tmp 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUSEARCH.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUNEWS.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ͼƬ\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUIMG.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷ 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ͼƬ 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDULYRIC.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-´ÊµäËÑË÷\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDU_DIC.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÍøÒ³ 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ÐÂÎÅ\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{B580CF65-E151-49C3-B73F-70B13FCA8E86} = 00 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷MP3\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUMP3.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷¸è´Ê\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷Ìù°É\ = "res://C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll/BAIDUPOST.HTM" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\°Ù¶È-ËÑË÷ͼƬ\Contexts = 10 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget.1\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\VersionIndependentProgID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735} 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\FLAGS\ = "0" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ProxyStubClsid32 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67} 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\ProgID\ = "BaiduBarEx.DropTarget.1" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\ProxyStubClsid32 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9} 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89FDCC4B-8D91-49B0-81A6-18BCFF582735}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ = "ITool" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\VersionIndependentProgID\ = "BaiduBarEx.DropTarget" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1\ = "AdFilter Class" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\ProgID\ = "MimeFilter.AdFilter.1" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE.1\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64} 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu.1\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CurVer\ = "BaiduBar.Tool.1" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\ProgID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget.1\ = "DropTarget Class" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget\CurVer 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.BandIE\ = "BandIE Class" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib\Version = "1.0" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib\Version = "1.0" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu\CurVer 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64} 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\InprocServer32 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\InprocServer32\ThreadingModel = "Apartment" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32\ThreadingModel = "Apartment" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6AFC2761-1253-427C-9A56-385B4609BE1D}\1.0\0\win32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Baidu\CLSID\ = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool.1 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter\ = "AdFilter Class" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}\InprocServer32 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\InprocServer32\ = "C:\\Progra~1\\Baidu\\bar\\BaiDuBar.dll" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ProxyStubClsid32 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{464C8A26-31E9-411C-9583-5B858E631DCC}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A294F8EB-86D9-4C4A-8B3E-909253761C64}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32\ThreadingModel = "Apartment" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C76C055-ED6E-4535-A70F-CD476E727F67}\TypeLib\ = "{6AFC2761-1253-427C-9A56-385B4609BE1D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\TypeLib 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96249369-D3DC-4AE6-8A3B-E7109D46E98D}\ = "ITool" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBar.Tool\CLSID 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BaiduBarEx.DropTarget.1\CLSID\ = "{7C76C055-ED6E-4535-A70F-CD476E727F67}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MimeFilter.AdFilter.1\CLSID\ = "{FE14F22E-BE14-4F08-A80F-F27BC3A67B2D}" 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\_µm: 81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81c1916faaf4854ca8b533468c48c811_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5d553b62a8136d41289513c6405efea2d
SHA1db48c3fd3993ff20511e47ffad14bfbdb9f438eb
SHA256ce7cfb626807084186b248bbf2ef776eac086da936146f7d44956c2fcfaec1f8
SHA5124a3767e8ac1e684a9a6eaced921b9599e34d5a4e83f034c7fe42bd8fd707a2b86f51ad485933fed5015554c3f9c4cf4b1357832964cc170d8cba86092fc9d2e2
-
Filesize
286KB
MD5e4bc62a44704db1e93d4e839781d1920
SHA11e9dcd259beff683a81432bf2539b047700a2f9a
SHA256e58dfa77619ef7d60c9f7ef40db74a81643ecf1886d1960be65578b18183b318
SHA5123bbc9e0745406863c27e9cb98bdd403b192840d905a9bba9bb02e86581d16805292c197c8a79ae6ee2f22c1ddc50f763b6e4ae95d21a9055b94abeb17ccdef04
-
Filesize
588B
MD5886a3c4174f4f95b51092a0cfeeb822c
SHA1eaf1332f2f03e8cafc7ee5dc211ac8e6faa3d3d1
SHA256228478419fbad9a1d37da2d06a1bdda885ddb0bc9bbb537fa7911abcde71f5f3
SHA512ea882630d1f2cd8e80db3283a30e301b05ac1561fd70a3c4bd623be368e31c009692635c91a4fd5ca3d7833354605fef64222acecbccc964ad449a2a44315920