d90dd97fbeca4377a9783c3ecc84889982fdbdd920ed4c1d04d879c68ac834c7

Analysis

max time kernel
139s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Size

94KB
MD5

eec456015479026f2a24f3dd8806eca0
SHA1

336a227d820fb2c6c8e8644e01b170e48f07d82f
SHA256

d90dd97fbeca4377a9783c3ecc84889982fdbdd920ed4c1d04d879c68ac834c7
SHA512

bc0e67e67c1695dc92ed9540560f92becd565caefe45880e0e8635e8df4cca99244256b30c1982df98b5c4911991c868303ff5e3838881a51615f8564e642097
SSDEEP

1536:LOM0m2EQFVRfF1nfbghAN4v/8om9lPMSk/+FOyj0XJJ2aErQNHjFZ:LO/Eo7t1nfboAGDslPMSkuO9AxrQNHjr

Score

10^/10

adware defense_evasion discovery persistence stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,c:\\windows\\system32\\Ieautoups.exe"	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2800	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2740	autoups.exe

Loads dropped DLL 3 IoCs

pid	Process
2892	regsvr32.exe
2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\autoups.exe	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\ieupdate.dll	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\Ieautoups.exe	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\Ieautoups.exe	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autoups.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000000d4e4a355c89a31104ecba9f04ab4affa99b28a0449ceb8332fe813276e0507d000000000e8000000002000020000000eb5c17bdbb9fe4686dd16fcea051703ff7202f7d916abfb5d978f73559eb96f990000000341926029ab30b6e7ef66186eb1fb430ee1aa28549af39d6f1490d0e9104a1c0e9606dcaad98594a08c5c5441fa46c78b254af5073b74342656844dfe77b71826d5dd849aa979e93a2db9ed774934b1fc1e6d809c930a8d7b0543bd336899ab2aa748b560b4f9ff35295095d309854aa33e41ce966eb23ca7f75e83d666c926fd197dee5b9eff2f2d1b1c854cf04910340000000fe65e208e4b79acda62e2dbc3b109b612ff7b34286720ec9ddd09ea8f858f22557408602c18a213b043c9a31332bc31071953d0a2b76b057fd96386cd5043de3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35E3B9B1-77B4-11EF-976E-62CAC36041A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a098ff4ac10bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000e84644c520c2f77ca88c66800f5eb4d0f31084ff15c45ff9ca98c69d38aed780000000000e80000000020000200000001eb0fbbd7a7d9b1c8568af8bd5cb9321109785eee9cc65a4902921d6bfb089b52000000053ea82b98ee661de2fe8a2f1085308c51957e75b809d0dc026b9fa8996d61cc640000000c337ad9b98faea84b65730025967e3b1051b420091dbae6cf17b92b2ed0dea458364c5d3ea0e87d4079886840bc095a2bb65d9fe8d217eae049749e3991e3297	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433042008"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lanren\url1 = "http://www.taobao.com"	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ = "_IE360"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lanren\tihuan1 = "http://gouwu.alimama.com/channel/channelCode.htm?pid=mm_10695343_0_0"	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\TypeLib\ = "{C7DA5AC5-FCD4-4B86-981A-88360778B67A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ = "_IE360"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\TypeLib\ = "{C7DA5AC5-FCD4-4B86-981A-88360778B67A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\HELPDIR\ = "c:\\windows\\system32"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\ = "¹¤³Ì1.IE360"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\ProgID\ = "¹¤³Ì1.IE360"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.IE360\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lanren\homepages = "www.dao78.cn"	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\ = "¹¤³Ì1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\0\win32\ = "c:\\windows\\SysWow64\\ieupdate.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.IE360	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lanren	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lanren\ = "lanren"	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\InprocServer32\ = "c:\\windows\\SysWow64\\ieupdate.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7DA5AC5-FCD4-4B86-981A-88360778B67A}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A86F0820-3B45-49C9-8BF8-95BFF0D29249}\TypeLib\ = "{C7DA5AC5-FCD4-4B86-981A-88360778B67A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.IE360\ = "¹¤³Ì1.IE360"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.IE360\Clsid\ = "{A86F0820-3B45-49C9-8BF8-95BFF0D29249}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7917EFB2-E9DC-4289-A1D0-8C40854A3C3B}\ = "IE360"	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	autoups.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2740	autoups.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
2972	iexplore.exe
2972	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2972	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2972	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2972	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	30
PID 2572 wrote to memory of 2972	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2964	2972	iexplore.exe	31
PID 2972 wrote to memory of 2964	2972	iexplore.exe	31
PID 2972 wrote to memory of 2964	2972	iexplore.exe	31
PID 2972 wrote to memory of 2964	2972	iexplore.exe	31
PID 2572 wrote to memory of 2696	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	32
PID 2572 wrote to memory of 2696	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	32
PID 2572 wrote to memory of 2696	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	32
PID 2572 wrote to memory of 2696	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2696 wrote to memory of 2892	2696	cmd.exe	34
PID 2572 wrote to memory of 2740	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	35
PID 2572 wrote to memory of 2740	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	35
PID 2572 wrote to memory of 2740	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	35
PID 2572 wrote to memory of 2740	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	35
PID 2572 wrote to memory of 2800	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	36
PID 2572 wrote to memory of 2800	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	36
PID 2572 wrote to memory of 2800	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	36
PID 2572 wrote to memory of 2800	2572	eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe	36
PID 2740 wrote to memory of 2888	2740	autoups.exe	39
PID 2740 wrote to memory of 2888	2740	autoups.exe	39
PID 2740 wrote to memory of 2888	2740	autoups.exe	39
PID 2740 wrote to memory of 2888	2740	autoups.exe	39
PID 2740 wrote to memory of 1724	2740	autoups.exe	42
PID 2740 wrote to memory of 1724	2740	autoups.exe	42
PID 2740 wrote to memory of 1724	2740	autoups.exe	42
PID 2740 wrote to memory of 1724	2740	autoups.exe	42

C:\Users\Admin\AppData\Local\Temp\eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eec456015479026f2a24f3dd8806eca0_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.dao78.cn/tongji/count/count.asp?id=62-CA-C3-60-41-A9&ver=1.0
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regsvr32 /s c:\windows\system32\ieupdate.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s c:\windows\system32\ieupdate.dll
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2892
- C:\Windows\SysWOW64\autoups.exe
  autoups.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c color 0a
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\autoups.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\a.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2fcddd4f233c4dee6dd409f87b4b352

SHA1
a00eaf0038b4bd77f679c2faf8b821dfac7b8e00

SHA256
c40c8d36c8eec86f40f9bd67afe38e3c3b82be884a722d83aef49c51b00d665b

SHA512
72141abdfbc0873650d673455b1207268744d10bfc7d7451a559ce0d5096224808cf4f0271471e11d88b1ef2acf0c6d005d135dce32459ad97a6c74515c629ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb1cd8f0efe56803c228b9ad2fc924d

SHA1
11d3978e3995b96af42a1d67033e6e3a8014cbc5

SHA256
c9c713c6b9999e661ca07d8b3723dee6751c86cfa75963c62aab929097c2dde4

SHA512
6d3f2605deb5441d306077e8d4059908f330d730999c168a55cedcd4daf153b9faf0e808767ca2b48eb075154ad83ea8dfcb195277b16903cabedbda6efb600d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79eee49b918e3700960951a6491beafc

SHA1
19efaf3b6c37f47cc1b321d663ee69af3b86f44e

SHA256
6d533d66d162f681402bf2d4376dcc53d66967fbb619030ccceb4a4b481871f5

SHA512
9f65147ebda3249100f0bcdda2e5214f1baa1988e14318b7175a80bc93ade668a2480973f3800f4901187cdd40a7ff6ac6cbdf83b187e4cc1585b5e7d9c4a253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
040bb710ad3ab5c49a41b121c779b5bd

SHA1
e1b38ac8073eecdc154d905e6c666df441e15630

SHA256
4c83bad73a7a9ee6fd03dd66743a6eec2fcc0ae47315137092f5b4f39f9df237

SHA512
8f898060afd80d39eb1d14cf35f2edf426a5076720eb60e8601c1b6746715ef2570772a7554bb4d96a8a5b526a88d909e2e901a2cde88b27c6f566de0621eefb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8df8977a806944bfc43daebe7ca40df4

SHA1
41762f1f6c9332dad1d550a1f58751d53f2d114a

SHA256
93d51f453d4853f7ab2dad6282ca09a138add7de15518a57f436b9f37a454eff

SHA512
c7e64ac01196920a66f019c323ba90aa322d9da5bba901cd5a016e35cf26417568e303d610ad6a522850ae485865c4b8b804079f3dcadd473feca05312b77012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b671ad98516d9fb529879fc90c910ae

SHA1
1af47c3aeb58ba86117da227976125568bf34d81

SHA256
752ecf190b9333184b8aeb35a522dbc0c9791ffc9f907f88f49d93af69a3fa59

SHA512
1857d7deb77213c2dde6ed7633391198d88fb412326574198e3e672ce9b8e61baf78fccd55bc4a094abd6cf3b57904392ae7067276f30d38a4444a8fc0c90b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d2a2b3fc935b782a41a7dd501a8e7b6

SHA1
cc78c82ab185b5f74f20295ffbb0165a55ff99fe

SHA256
acf02037bd1d95ae086650d5539fc3dfbbc1c95222f7971604864700c53d7242

SHA512
79ec6c1303a306e96141a5043d8380929bd852b51f5ee696e049aa5cd6e2a0b9d68233aeaf4b17594c8105bc26987ec699e9e33fa92e03304b41f93d836cb473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65c7b52b1d2e59071d7157af15ee842b

SHA1
bcf663cd0685100652965f642ef69ea9b3cf651a

SHA256
36056e97d9ac4636d13a8bee42825454e63962a696dbe8d1f244975003455a92

SHA512
037147262dd9e6389d23e02e292b2526e584e675d2515a3d7998abfa8441707e868fd1663dbeae3a714b15daec3917e5966160e86559fca687cc57a3e12331d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b469040a4742614013e17769fa91aa2

SHA1
3bf0c00ef000d046c9ee294d567bfb03c8223bc0

SHA256
c593819c8cda492ecc4baaae0c31f4c9abb87b41b744e727a31152f2f26aeaf3

SHA512
c9dde31eb449029ecdd8fbe371d006964c5060295c4c70128ae346ef9cb0447e250904b933c3ce69ced5fa75dd87a92318a26e00a06e97cb4caa8a055710d156

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B65.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA3D3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a.bat

Filesize
218B

MD5
ac2e7ca5909d0c139a8fa84641fbd5bd

SHA1
3e1827ff992a976f2e979ff0aa0fbc1475183d11

SHA256
e8c58fffc48ce9364567d21c10e49b4a3bd4ffde4972d5e4e36d519eb9f98237

SHA512
f19448e4ddbaa2da811409cc5829a0fe92f67e3e831d689c6ee267f1a748f98a1f6d957f37db25922e381fbcad59d17dee294f465b03a8bc3de8b3416fe653d5

Download Submit
C:\Windows\SysWOW64\autoups.exe

Filesize
180KB

MD5
22cb3a551f770013b87d080e18c8f705

SHA1
71f207cd184ef3e62f58472ffeaa47dbb1b06df4

SHA256
6362e53304c62b7183a43f1462719de95a16462d4a3607a993f5504f039e1192

SHA512
b80e5480108a40ba672089409e633eeadbf3f7dccfe10114fd25c7412540a1c1aa0b9e776c12b07dcfee555057ec8356043aa2a8e5fde316a0694ac86cc345e4

Download Submit
\??\c:\windows\SysWOW64\ieupdate.dll

Filesize
36KB

MD5
f129037d2b48bc4cf68c2057c087bf0f

SHA1
ec5b9aec356374b5c734698ae587f2faa344e9f9

SHA256
3b02cf5ba7165cf551f2cdebfb53200914cec6f175c38656ef7817a8153eb4d7

SHA512
a6cc088716cbc0e5615f8c487ac85b423b7e8b593e5aa60ed217adaf0e3689cfb189e43a730ab38f71a250570e0fcaa240cade6a61ed10bcce99f4b39ce34216

Download Submit
memory/2572-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2572-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads