a5df26ac15a8125cd3c4b5035e05a8e7ec4b6123cf9e87065f26aa25d005d71a

Analysis

max time kernel
126s
max time network
65s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Size

575KB
MD5

a4747e7f29a54182f9eb25ffbbe3fa3a
SHA1

9845e99bb9836ad35b3df3155bb336e7af79f747
SHA256

a5df26ac15a8125cd3c4b5035e05a8e7ec4b6123cf9e87065f26aa25d005d71a
SHA512

ae15ab6029456fc816083441823ddc431d156269e428e1159856a9f97acb6512fc98ac936b071dcb19daa1e84917550e65286959a4a619bdb34103557a766f44
SSDEEP

12288:ZaEr+K1+F94srm2mQGZXhvXVCpbscjhzrP5e1+F9Esrm2tQGdBcKTOh:ZaLL9ZyPZxvXVC/jhzbR9NxPdBc9

Score

7^/10

adware discovery stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000019256-3.dat	acprotect
behavioral1/memory/2320-5-0x0000000074AB0000-0x0000000074AB9000-memory.dmp	acprotect

Deletes itself 1 IoCs

pid	Process
1004	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2840	svcspwin.da.exe
2972	svcspwin.exe
2600	svcspwin.exe
2448	svcspwin.exe

Loads dropped DLL 11 IoCs

pid	Process
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2840	svcspwin.da.exe
2840	svcspwin.da.exe
2840	svcspwin.da.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000019256-3.dat	upx
behavioral1/memory/2320-5-0x0000000074AB0000-0x0000000074AB9000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\ = "WinsPopAPI Helper"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcspwin.da_	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svcspwin.da	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svcspwin.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WinsPop\winspb.da_	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
File created	C:\Program Files (x86)\WinsPop\winspb.da	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
File created	C:\Program Files (x86)\WinsPop\winsps.da_	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
File created	C:\Program Files (x86)\WinsPop\winsps.da	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
File created	C:\Program Files (x86)\WinsPop\uninst.exe	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcspwin.da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcspwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcspwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcspwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\SOFTWARE\Microsoft\Internet Explorer\Main	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svcspwin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47EFC229-BCA3-44D2-98ED-D4F009D9CB44}\WpadDecisionTime = 702f03def7f0da01	svcspwin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47EFC229-BCA3-44D2-98ED-D4F009D9CB44}\WpadNetworkName = "Network 3"	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47EFC229-BCA3-44D2-98ED-D4F009D9CB44}\32-23-4c-fb-c5-61	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svcspwin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svcspwin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svcspwin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svcspwin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0021000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svcspwin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-23-4c-fb-c5-61\WpadDecisionTime = 702f03def7f0da01	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-23-4c-fb-c5-61\WpadDecision = "0"	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47EFC229-BCA3-44D2-98ED-D4F009D9CB44}\WpadDecision = "0"	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-23-4c-fb-c5-61	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-23-4c-fb-c5-61\WpadDecisionReason = "1"	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svcspwin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47EFC229-BCA3-44D2-98ED-D4F009D9CB44}	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{47EFC229-BCA3-44D2-98ED-D4F009D9CB44}\WpadDecisionReason = "1"	svcspwin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svcspwin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svcspwin.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\ProgID	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\TypeLib\ = "{31C3FB97-CFD9-4745-BE40-1E5F5702635E}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\FLAGS\ = "0"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\VersionIndependentProgID\ = "WinsPopBHO.WinsPopAPI"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\Programmable	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1\ = "WinsPopAPI Class"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1\CLSID	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CLSID\ = "{66B39A8A-3134-47b7-85C6-3E7DF7D14586}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CurVer	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\HELPDIR	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\tkcd = "a8a39fa4"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ = "IWinsPopAPI"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib\Version = "1.0"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\ProgID\ = "WinsPopBHO.WinsPopAPI.1"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\TypeLib	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid32	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib\ = "{31C3FB97-CFD9-4745-BE40-1E5F5702635E}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\InprocServer32\ = "C:\\Program Files (x86)\\WinsPop\\winspb.dll"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\0	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib\Version = "1.0"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CLSID	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\FLAGS	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ = "IWinsPopAPI"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\TypeLib\ = "{31C3FB97-CFD9-4745-BE40-1E5F5702635E}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI.1\CLSID\ = "{66B39A8A-3134-47b7-85C6-3E7DF7D14586}"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\ = "WinsPop Hlp"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\InprocServer32\ThreadingModel = "Apartment"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\0\win32	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\0\win32\ = "C:\\Program Files (x86)\\WinsPop\\winspb.dll"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WinsPop\\"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CBC618F-898B-46DC-8B67-28D93FE9C7DF}\ProxyStubClsid32	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\ = "WinsPopAPI Class"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinsPopBHO.WinsPopAPI\CurVer\ = "WinsPopBHO.WinsPopAPI.1"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\VersionIndependentProgID	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66B39A8A-3134-47b7-85C6-3E7DF7D14586}\InprocServer32	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31C3FB97-CFD9-4745-BE40-1E5F5702635E}\1.0\ = "WinsPopAPIClass 1.0 Type Library"	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1004	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2840	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2972	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2600	2320	a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4747e7f29a54182f9eb25ffbbe3fa3a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1004
- C:\Windows\SysWOW64\svcspwin.da.exe
  "C:\Windows\System32\svcspwin.da.exe" /stop
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Windows\SysWOW64\svcspwin.exe
  "C:\Windows\System32\svcspwin.exe" /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2972
- C:\Windows\SysWOW64\svcspwin.exe
  "C:\Windows\System32\svcspwin.exe" /start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2600

C:\Windows\SysWOW64\svcspwin.exe
C:\Windows\SysWOW64\svcspwin.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\WinsPop\winspb.dll

Filesize
79KB

MD5
3b7e3190059452e7d4835321cd166039

SHA1
75f6ba8997b6954fcc532eb2b7f2d126556f7c64

SHA256
feb6b7a5e85fd8962996d24deb395ff00c36bb4521956e1beee6d01d0c2ec924

SHA512
8548ed798e9edfb22db88c23e3abe6fc96b860688ac72f42e4f1c8a2a714bbd51a8b117c574b4dfec9eb454154661cb378b0cf7a60a6dce3c458b6a0d982d1a8

Download Submit
\Users\Admin\AppData\Local\Temp\nsuC10F.tmp\SelfDel.dll

Filesize
4KB

MD5
7cff7fe2caea5184d98c147e7e263132

SHA1
21f39d3d0dd5f7198d67ef30e95d10ae3460093e

SHA256
281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101

SHA512
fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a

Download Submit
\Users\Admin\AppData\Local\Temp\nsuC10F.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsuC10F.tmp\nsProcEx.dll

Filesize
24KB

MD5
0216cab025a4ea223141f66cbe14ccaf

SHA1
b08b563d5fd794e17208912e8237c961bca5516f

SHA256
c5c30c304347226e4ae6b758ba6ba0589cf1c0aee55886c4354859088bf88cf7

SHA512
e870aa7381e459e4114529efbfe0a354216b8e846c7c60e550749c6c625b98f8633da5e30192737a5f65de387f9497eebaf6502615cbb6fa16da5b8c5574207a

Download Submit
\Users\Admin\AppData\Local\Temp\nsuC10F.tmp\nsProcess.dll

Filesize
4KB

MD5
8f4ac52cb2f7143f29f114add12452ad

SHA1
29dc25f5d69bf129d608b83821c8ec8ab8c8edb3

SHA256
b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04

SHA512
2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c

Download Submit
\Users\Admin\AppData\Local\Temp\nsuC10F.tmp\winsps.dll

Filesize
383KB

MD5
c0da7a6055d7f951a26c5b77461bed66

SHA1
6eee24f993c2a2427b534e5ed9e1a8ed887af402

SHA256
99987e5adc8c218f4cf2b0e76182310913026310c2a8c7506bcf192e6e14e2c9

SHA512
f1b9a243aec5313e38e60e0309881bfffa5afdf7cf79018df9bbfddbb4ed904ea7e7eaa69d59f4d065eb5140f94f3dfe08f2360603ff5b728b57cee900142d4a

Download Submit
\Windows\SysWOW64\svcspwin.da.exe

Filesize
91KB

MD5
7be8571e5de6824e8ce1221cde75ec5c

SHA1
b95bb307f583c2fe306d61e3458087eacdc3e5ba

SHA256
1d4606b3e46bf9934c173843289f268dc6cda6ab8ec54bfc80deea8ad7c67b05

SHA512
270cfcca3d569d65133fbbc3f9a84fdd8fc16213aef3a29bed82bc58938f8b72c4d99bd9f2641a95e3c08e466f63820675d6b5cc5e1484de45d7f238057c99ef

Download Submit
memory/2320-5-0x0000000074AB0000-0x0000000074AB9000-memory.dmp

Filesize
36KB

Download
memory/2320-29-0x0000000002820000-0x0000000002883000-memory.dmp

Filesize
396KB

Download
memory/2320-59-0x0000000000B80000-0x0000000000B94000-memory.dmp

Filesize
80KB

Download