Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
eabc72853fb8f18c4899eb163dfa2415
-
SHA1
23e00f54e9dd89a8ee3830913b4fc676910cbf75
-
SHA256
fb73f3eeec877bca2a0b3a9cce8416ce11ceec7aee82277896a11c08686d2f16
-
SHA512
556f47de7441fdb0a15a3dd62d2ce4326228ba3b726e6921a6430d77f0eb966cc5700d9112a24da81cacf7bf048039243a75762f654852e063703827b6251c3f
-
SSDEEP
24576:x5b8rFrYRFS7Iid6Nx7izcFsaWrtLTOITQA6kOStpbspT63cGnJ/2aDZM/2YH7Xf:crFrZDd6ziVTOITQAOpT63cGnJ/WbJfx
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 3064 ietheword.exe 2624 Loader_forqd318.exe -
Loads dropped DLL 2 IoCs
pid Process 4436 regsvr32.exe 4436 regsvr32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ietheword.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File created C:\Program Files\Alisoft1\Internet Explorer\desktop.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\Program Files\Alisoft1\ºÃÍæСÓÎÏ·\desktop.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File opened for modification C:\program files\ieworld\ietheword.ini ietheword.exe File opened for modification C:\PROGRA~1\ieworld\twcache.ini ietheword.exe File opened for modification C:\Program Files\Alisoft1\Internet Explorer attrib.exe File opened for modification C:\Program Files\Alisoft1\ºÃÍæСÓÎÏ· attrib.exe File created \??\c:\program files\C07116A0\Loader_forqd318.exe eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created \??\c:\program files\ieworld\ietheword.exe eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File opened for modification \??\c:\program files\ieworld\ietheword.exe eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\PROGRA~1\ieworld\theworld.ac ietheword.exe File created C:\program files\ieworld\ietheword.ini.tmp ietheword.exe File created C:\Program Files\Alisoft1\Internet Explorer\desktop.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\Program Files\Alisoft1\Internet Explorer\target.lnk eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\Program Files\Alisoft1\ºÃÍæСÓÎÏ·\desktop.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File opened for modification C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô attrib.exe File created \??\c:\program files\ieworld\ietheword.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\PROGRA~1\ieworld\twcache.ini ietheword.exe File created C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\target.lnk eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File created C:\Program Files\Alisoft1\ºÃÍæСÓÎÏ·\target.lnk eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File opened for modification C:\PROGRA~1\ieworld\theworld.ac ietheword.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\javalava.dll eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe File opened for modification C:\Windows\javalava.dll eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ietheword.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader_forqd318.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ietheword.exe = "1" ietheword.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\ietheword.exe = "1" ietheword.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" ietheword.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE ietheword.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\ietheword.exe = "0" ietheword.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION ietheword.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch ietheword.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" ietheword.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\IESettingSync ietheword.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT ietheword.exe -
Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ig eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon\ = "%1" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\Internet Explorer\"" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.it eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ = "C:\\Windows\\javalava.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.iy eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon\ = "%1" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ = "Java (TM)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\È¥ÌÔ±¦ÌØÂô\"" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon\ = "%1" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\otfile eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.it\ = "otfile" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid\ = "{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ig\ = "ogfile" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\ºÃÍæСÓÎÏ·\"" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\ = "Java (TM)" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.iy\ = "oyfile" eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM) regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID\ = "javalava.Java (TM)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 ietheword.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 ietheword.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c9030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 ietheword.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb28190f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 ietheword.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000040000000100000010000000a7f2e41606411150306b9ce3b49cb0c9030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 ietheword.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe 3064 ietheword.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4980 wrote to memory of 3064 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 82 PID 4980 wrote to memory of 3064 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 82 PID 4980 wrote to memory of 3064 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 82 PID 4980 wrote to memory of 3628 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 92 PID 4980 wrote to memory of 3628 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 92 PID 4980 wrote to memory of 3628 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 92 PID 4980 wrote to memory of 3892 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 94 PID 4980 wrote to memory of 3892 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 94 PID 4980 wrote to memory of 3892 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 94 PID 4980 wrote to memory of 4540 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 96 PID 4980 wrote to memory of 4540 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 96 PID 4980 wrote to memory of 4540 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 96 PID 4980 wrote to memory of 4436 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 97 PID 4980 wrote to memory of 4436 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 97 PID 4980 wrote to memory of 4436 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 97 PID 4980 wrote to memory of 2624 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 100 PID 4980 wrote to memory of 2624 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 100 PID 4980 wrote to memory of 2624 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 100 PID 4980 wrote to memory of 2372 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 101 PID 4980 wrote to memory of 2372 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 101 PID 4980 wrote to memory of 2372 4980 eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe 101 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 3628 attrib.exe 3892 attrib.exe 4540 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\program files\ieworld\ietheword.exe"C:\program files\ieworld\ietheword.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3064
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s "C:\Program Files\Alisoft1\Internet Explorer"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3628
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s "C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s "C:\Program Files\Alisoft1\ºÃÍæСÓÎÏ·"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4540
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Windows\javalava.dll" -s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4436
-
-
\??\c:\program files\C07116A0\Loader_forqd318.exe"c:\program files\C07116A0\Loader_forqd318.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\pipiuni.bat2⤵
- System Location Discovery: System Language Discovery
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5bef14d54106a5129182af8b04747adbf
SHA101fa77e1237e29f938b4c5d703946a559b2e563c
SHA25649b6779a2221ee3658da0f906b26843b65826cfdf8263b2e438b43467259c603
SHA512c304fb79824d8bfe30f927afed9abcc5d8b3349a1f2fd29f7b9d129918e42eeb84ab7c1fd9492c442bc50f6a047609843d8fbe3c59e02d1e58dcbbbaf0b9bea2
-
Filesize
1.4MB
MD5a1272a8305fa1f55de6701e9048a60f0
SHA190c5def58931ff14c84bba3826bff0aa065faea5
SHA2563fc7c2588ebbadc9ef4710e936f44230a1147dfaa8d562fe3b6035ad5ffbbb6c
SHA512510d2e2ac7cfd6930ac3a5ff9aa93df65795473de884162289edc6930315e93648b7cceedf7090a47025bcc0efb1497917441ba5023f459943b217992444eff2
-
Filesize
8KB
MD5e3ff8d3cfdc159555abb8abe9834f611
SHA161e5c3f58bc97d63658f5927584bd073942ba053
SHA2567af6ad94dc99df502aece61da80b7394f4fd44cec7bab9b43adacd7f723bf013
SHA51286acc0da236344987065f12456097a634b478274fea38ac7cb12a1b5426edcc5fa3d82188964f83d04fe9a792b332f570c794deca34855d7ff300f7041cc7f49
-
Filesize
144B
MD5fee8dafce13cf2ebebc5f4faa5ff4813
SHA112111abcc674ca5ea8eb62671d51a1fb6a2d2bb2
SHA25648409b540f04ef8b8e603001f4542c0e7f930e6fe4ad8fcac494e4841fed5d09
SHA512a85588b8a45d22135d966ad8a329f476e5172263e26912668aa64edeee6c01894bd065be807598bdf7d704973b91e71e317f4d6597322b0692b00640bee1417e
-
Filesize
435KB
MD5c14ec251e23bf14a2fec37085402662c
SHA1075906fdf396b327784575d2bc3f2642e30d0197
SHA2566e72b8f42cd201d96e8651e0e515a0007723014b68c6823456e4354018577b1f
SHA512a4adc9e86176a1ff19d94af424011e42048d801e29e48038a633c1ec5dbf2aca98de4f49fd7f1d5792447a1b52785f4bc8622a84d761e1f513fed79e7eaf96e0
-
Filesize
8KB
MD57c5c7ef31c01be7dc9aab07197d59052
SHA11732f6eab1f5727362bbb25028afd760f777c770
SHA256bfdb19348faace85b8eb971be8e6329a8defa94b7158bb0b32b274b09494077d
SHA5120c3c0e648750df08041d555e843599375440c4762ceb2650d73a97868709a326b47c352decd79e5a5b44b604ed3cb28c46f41c8fa6bea9272a9ae0de68d3f5a9