Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe
-
Size
8.5MB
-
MD5
95161bb1f97042586a30aa5a2e4749dd
-
SHA1
eb09a1aa82ac26f37cebd16cec188cee3d834ead
-
SHA256
d5fdd344a56b8e4b65bf1dc70f34938ab5a5a45158d0586a7fc6387dd9c6fcd6
-
SHA512
ba9255d5e224931f5ac521fbfda2048f906e0ed796aacf55ba9c4ef7d866d6b0b6e7ebe02669cad61de7160b5f439c2b245c64a095c06ebcd24db85dba8ddc83
-
SSDEEP
196608:Row8oMX+XufWKkstZbP+e45YDolxIONtGfm9CGolvM1B6N:WiJKtvexI0AfmUG3K
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
Executes dropped EXE 3 IoCs
pid Process 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 4620 KuGoo.exe 2040 KuGoo.exe -
Loads dropped DLL 4 IoCs
pid Process 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 984 regsvr32.exe 984 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\is-0UQ7S.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
Drops file in Program Files directory 62 IoCs
description ioc Process File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-USNPU.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-EC8TG.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-RCTHN.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-UFHJV.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-47MUC.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\KGData.db KuGoo.exe File created C:\Program Files (x86)\KuGou\KuGou2011\KGData.db-journal KuGoo.exe File created C:\Program Files (x86)\KuGou\KuGou2011\is-LLVBS.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-IQLE0.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\Install.ini 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-F41NH.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-57MPF.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-JOT3Q.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-40JTF.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-0JAS8.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-RIHKG.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\Skins\Subject\is-7509Q.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\LastStatus.dat KuGoo.exe File created C:\Program Files (x86)\KuGou\KuGou2011\is-OVSH3.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-7N516.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\SingerRes 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-R6758.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-USNMG.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-O54K0.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-MAQ8I.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-CAKCJ.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\config.ini 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\ver.ini 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-CVD24.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-MF37B.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-SQUCL.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-FT4II.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-IVUH3.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\unins000.dat 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\SingerRes9D94580A-EB27-4233-A1B5-70577835D89E 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-5PRJC.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-1LH1J.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-R9BQF.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\HotImages\is-07IUI.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-SS3LA.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\DSPPlugins\is-V2JS5.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-QTCN7.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-UPT2R.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-LNN3J.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-OVFSI.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-UR24L.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-AJV4K.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-7NOVU.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-6GQAH.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-VBIOF.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-OR54K.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-LS1HB.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\KuGoo.xml 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\unins000.dat 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File opened for modification C:\Program Files (x86)\KuGou\KuGou2011\LastStatus.dat KuGoo.exe File created C:\Program Files (x86)\KuGou\KuGou2011\is-K1SG3.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-2FP90.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AudioPlugins\is-KBF91.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-DV2G3.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\AddIns\is-NE0RM.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-OHUCF.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp File created C:\Program Files (x86)\KuGou\KuGou2011\is-2QV2E.tmp 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KuGoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KuGoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4CD0819E-5D7C-492B-8FE2-056DB13EFA9B}\AppPath = "C:\\Program Files (x86)\\KuGou\\KuGou2011" 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4CD0819E-5D7C-492B-8FE2-056DB13EFA9B}\Policy = "3" 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4CD0819E-5D7C-492B-8FE2-056DB13EFA9B} 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4CD0819E-5D7C-492B-8FE2-056DB13EFA9B}\AppName = "Kugoo.exe" 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.CUE\DefaultIcon\ = "C:\\Program Files (x86)\\KuGou\\KuGou2011\\KuGoo.exe,2" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AIF KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MIDI\ = "????MIDI??" KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.WAV\Shell\PlayList KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.APE\DefaultIcon\ = "C:\\Program Files (x86)\\KuGou\\KuGou2011\\KuGoo.exe,1" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.CUE\Shell\Open\ = "??(&O)" KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\ = "IKuGoo3Down" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MP1\Shell\PlayList KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.M3U\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\KuGou\\KuGou2011\\KuGoo.exe\" /Open \"%1\"" KuGoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.FLAC\Shell\Open KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.CUE\ = "????CUE??" KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\ = "KuGoo3DownXControl Library" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MP3\DefaultIcon KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AIFF KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.WMA\Shell\Open KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.WAV\Shell\PlayList\ = "???“????”????(&P)" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MID\Shell\PlayList KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.DTS\ = "????DTS??" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.KGM\DefaultIcon KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MP2\Shell\Open KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.KRC\Shell\PlayList\ = "???“????”????(&P)" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.DTS\Shell\PlayList\Command KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.DTSWAV\Shell\PlayList\Command KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AAC\ = "????AAC??" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AIF\Shell\PlayList\ = "???“????”????(&P)" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AIFF\Shell KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MIDI\DefaultIcon KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AU\Shell\Open\ = "??(&O)" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AU\Shell\PlayList\ = "???“????”????(&P)" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\.A52\ = "KuGoo.A52" KuGoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\.wma\ = "KuGoo.WMA" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.WMA\Shell\Open\ = "??(&O)" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.M3U\Shell\Open\ = "??(&O)" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.CDA\Shell\PlayList\Command\ = "\"C:\\Program Files (x86)\\KuGou\\KuGou2011\\KuGoo.exe\" /List \"%1\"" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.RMI\Shell\Open KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AU\ = "????AU??" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AU\Shell\PlayList KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AC3\Shell\Open\ = "??(&O)" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.FLAC\Shell\PlayList\ = "???“????”????(&P)" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MIDI\Shell\Open\Command KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.DTS\Shell\Open\ = "??(&O)" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.OGG\Shell KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo.KFS\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\KuGou\\KuGou2011\\KuGoo.exe\" /ApplySkin \"%1\"" KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\ = "IKuGoo3DownEvents" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AA KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo.KFS\ = "????KFS??" KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.WMA\Shell\PlayList KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.FLAC\Shell\PlayList\Command KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.FLAC\Shell\PlayList\Command\ = "\"C:\\Program Files (x86)\\KuGou\\KuGou2011\\KuGoo.exe\" /List \"%1\"" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MIDI\Shell\Open\ = "??(&O)" KuGoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AIFF\Shell\Open\ = "??(&O)" KuGoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo.KFS\Shell\Open\Command KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.OGG\Shell\Open KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.AIFC\DefaultIcon KuGoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Down\Clsid\ = "{162AF25B-5A2A-448E-A842-194653EF3E05}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\KuGoo.MP1\Shell\PlayList\Command KuGoo.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\.WAV KuGoo.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2840 wrote to memory of 4468 2840 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe 87 PID 2840 wrote to memory of 4468 2840 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe 87 PID 2840 wrote to memory of 4468 2840 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe 87 PID 4468 wrote to memory of 4620 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 91 PID 4468 wrote to memory of 4620 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 91 PID 4468 wrote to memory of 4620 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 91 PID 4468 wrote to memory of 984 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 92 PID 4468 wrote to memory of 984 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 92 PID 4468 wrote to memory of 984 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 92 PID 4468 wrote to memory of 2040 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 93 PID 4468 wrote to memory of 2040 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 93 PID 4468 wrote to memory of 2040 4468 95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\is-CGNMQ.tmp\95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-CGNMQ.tmp\95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.tmp" /SL5="$70056,8487278,334336,C:\Users\Admin\AppData\Local\Temp\95161bb1f97042586a30aa5a2e4749dd_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files (x86)\KuGou\KuGou2011\KuGoo.exe"C:\Program Files (x86)\KuGou\KuGou2011\KuGoo.exe" Import3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4620
-
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32" /s "C:\Windows\system32\KuGoo3DownXControl.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:984
-
-
C:\Program Files (x86)\KuGou\KuGou2011\KuGoo.exe"C:\Program Files (x86)\KuGou\KuGou2011\KuGoo.exe" RegFileType3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2040
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5fc47c41e076d6792005c1114f8e4750e
SHA192839a188726b6dbc1b9a48039c211c2c6821970
SHA256da3d5f3ec67aaa6c094fc0ffac664bd176ce22170b85df0219edcc62415675c9
SHA5126fcfd75f3409fbb90ffb923a7a981a179780de046c24fda9d177108a591f58d3d431d81079b61ef5ad6e19f2d472fcdafaf2a606f5356449e27759da26e56bd8
-
Filesize
5.0MB
MD5183136842229298dd52e6c6522b1c2e1
SHA1af3e3e922e91047038136eb0c5ebb2837061ac71
SHA2561488e09d725771d1d161a94db533ec531eed7ccba6047feb62ac1a41cdb24d3b
SHA512aa5ca160076db72a4a2e967637bae4592868dad8c9663c353311d66d0ec08f82430ec8397ebe38f129ff5a6e59a0794f468a693f986cba652a8e2ea6158f5398
-
Filesize
76B
MD5d017422f57404e497583cbd6434c0370
SHA1d4abe09d26daffc8b5ce0de41ebf57924434bf97
SHA25666400f85e33a67b1ddb7cbf3b5755156c2b2f00ea5d4fc5c22316d62ecc5fa93
SHA512fb0b393bc24bd6c31293d68edd739fa8e5a3cc89fb1d0daffa3f9016a80f39796332a3e18abc7db13b34b017ff2e0610b0a0304075c765a02446f89194e73771
-
Filesize
1KB
MD517eb56254368606db0b76221b9896fbb
SHA12968f223c92d4137f200802233fa838db8978759
SHA2566e10876fbf5097ee20c853d2acdff3d0e0b43be221eae67f4faad22dcdbb5f9c
SHA51211ef1d7567980fcc01db8cf4b511f4d0c86437cd511053782c6ee672ace45c9f1fdcabda44a41115edf9de33ee20f7931fd371f7c8cdebe7099a9551081082e8
-
Filesize
218KB
MD585c67b2a4d86fd203371f01717552120
SHA1907520eee11495a048d8b2156c7d891dc9c3fb6a
SHA2568fd9ab32f83cfe295cfed91af26bcddb2f346df6d64595d81bf42560375f6f0a
SHA512c0efedda23bcf0143010f1c42eb3f31e7774d230725853c753bfd7230f81b4e9bc05ba58cd5083548f2b00cf53bf99f67abe03b526a79f28703f1ac6d0e40713
-
Filesize
890KB
MD597d0ecc3818ac94578dcc53826f49864
SHA191f1c2aa7697806af5fbb846cac3f2f0c482373d
SHA2566200e285c0e8df3778239eea3e17d47e6265f44df9cf5d979e6627ac12f37599
SHA5124f8a099cea09525c4d780b83c540b8fe6342ee484f55cf1e48cc00286f0d763b27bb81194569ba03db715d7dad0f727cd47fdaa762af63a05e51ba78e1d18a4e
-
Filesize
538KB
MD51c711b957bbf41c9814b230e03e6b028
SHA115d890675cd61e8b241a43f5536c28ca9c6f9d4a
SHA256c8686f00ec63656af348b970872378504d889b7290808052d13530669fd7121b
SHA512d0f17e10751bc700ec3475a4ba5a646f91129bfd63d8ce99669afbfeec28637806f739c2a8404e75a4bae6ab8394717e8c13207bc9eeb129efb391da8e30aee1