c30169e2400cbd8cb0944b98f519508b7c7c23b9a5aa42ef25713c5c6ffa236e

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Size

2.0MB
MD5

f660f8a8edb2b437363c590420ae04c1
SHA1

980e4dc7cc60282b3cd99a97eaa47073783371ed
SHA256

c30169e2400cbd8cb0944b98f519508b7c7c23b9a5aa42ef25713c5c6ffa236e
SHA512

d38ddaf2f940be37d9c38a4255110a6621e6ab0bfac9622507899af2b6f43b1d1bf5bd6c243174ec35f63cdb0af514af71f5658bfc013fd77b908f4ed912dfea
SSDEEP

24576:x5b8rFrYRFS7Iid6Nx7izcFsaWrtLTOITQA6kOStpbspT63cGnJ/2aDZM/2YH7Xo:crFrZDd6ziVTOITQAOpT63cGnJ/WbJfy

Score

7^/10

adware discovery evasion stealer trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3412	ietheword.exe
440	Loader_forqd318.exe

Loads dropped DLL 2 IoCs

pid	Process
3632	regsvr32.exe
3632	regsvr32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ietheword.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Program Files\Alisoft1\Internet Explorer\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	\??\c:\program files\ieworld\ietheword.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ieworld\ietheword.exe	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\PROGRA~1\ieworld\twcache.ini	ietheword.exe
File opened for modification	C:\PROGRA~1\ieworld\twcache.ini	ietheword.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·	attrib.exe
File created	\??\c:\program files\C07116A0\Loader_forqd318.exe	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\target.lnk	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\ieworld\theworld.ac	ietheword.exe
File created	C:\program files\ieworld\ietheword.ini.tmp	ietheword.exe
File created	C:\Program Files\Alisoft1\Internet Explorer\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\Internet Explorer\target.lnk	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\target.lnk	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\Internet Explorer	attrib.exe
File opened for modification	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô	attrib.exe
File created	\??\c:\program files\ieworld\ietheword.exe	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\PROGRA~1\ieworld\theworld.ac	ietheword.exe
File opened for modification	C:\program files\ieworld\ietheword.ini	ietheword.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\javalava.dll	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\Windows\javalava.dll	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ietheword.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader_forqd318.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\IESettingSync	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	ietheword.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\ietheword.exe = "1"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\ietheword.exe = "0"	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ietheword.exe = "1"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	ietheword.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\È¥ÌÔ±¦ÌØÂô\""	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ig	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ = "Java (TM)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iy\ = "oyfile"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\ = "Java (TM)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID\ = "javalava.Java (TM)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iy	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.it	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ig\ = "ogfile"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ = "C:\\Windows\\javalava.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon\ = "%1"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.it\ = "otfile"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon\ = "%1"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid\ = "{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\Internet Explorer\""	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon\ = "%1"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\ºÃÍæÐ¡ÓÎÏ·\""	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	ietheword.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c9030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	ietheword.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb28190f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	ietheword.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000040000000100000010000000a7f2e41606411150306b9ce3b49cb0c9030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	ietheword.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	ietheword.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe
3412	ietheword.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3412	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	84
PID 4544 wrote to memory of 3412	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	84
PID 4544 wrote to memory of 3412	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	84
PID 4544 wrote to memory of 3048	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	94
PID 4544 wrote to memory of 3048	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	94
PID 4544 wrote to memory of 3048	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	94
PID 4544 wrote to memory of 836	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	96
PID 4544 wrote to memory of 836	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	96
PID 4544 wrote to memory of 836	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	96
PID 4544 wrote to memory of 4572	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	98
PID 4544 wrote to memory of 4572	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	98
PID 4544 wrote to memory of 4572	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	98
PID 4544 wrote to memory of 3632	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	99
PID 4544 wrote to memory of 3632	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	99
PID 4544 wrote to memory of 3632	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	99
PID 4544 wrote to memory of 440	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	102
PID 4544 wrote to memory of 440	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	102
PID 4544 wrote to memory of 440	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	102
PID 4544 wrote to memory of 316	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	103
PID 4544 wrote to memory of 316	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	103
PID 4544 wrote to memory of 316	4544	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	103

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
836	attrib.exe
4572	attrib.exe
3048	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4544
- C:\program files\ieworld\ietheword.exe
  "C:\program files\ieworld\ietheword.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3412
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\Internet Explorer"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3048
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:836
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4572
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 "C:\Windows\javalava.dll" -s
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3632
- \??\c:\program files\C07116A0\Loader_forqd318.exe
  "c:\program files\C07116A0\Loader_forqd318.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\pipiuni.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\C07116A0\Loader_forqd318.exe

Filesize
65KB

MD5
bef14d54106a5129182af8b04747adbf

SHA1
01fa77e1237e29f938b4c5d703946a559b2e563c

SHA256
49b6779a2221ee3658da0f906b26843b65826cfdf8263b2e438b43467259c603

SHA512
c304fb79824d8bfe30f927afed9abcc5d8b3349a1f2fd29f7b9d129918e42eeb84ab7c1fd9492c442bc50f6a047609843d8fbe3c59e02d1e58dcbbbaf0b9bea2

Download Submit
C:\Program Files\ieworld\ietheword.exe

Filesize
1.4MB

MD5
a1272a8305fa1f55de6701e9048a60f0

SHA1
90c5def58931ff14c84bba3826bff0aa065faea5

SHA256
3fc7c2588ebbadc9ef4710e936f44230a1147dfaa8d562fe3b6035ad5ffbbb6c

SHA512
510d2e2ac7cfd6930ac3a5ff9aa93df65795473de884162289edc6930315e93648b7cceedf7090a47025bcc0efb1497917441ba5023f459943b217992444eff2

Download Submit
C:\Program Files\ieworld\ietheword.ini

Filesize
8KB

MD5
e3ff8d3cfdc159555abb8abe9834f611

SHA1
61e5c3f58bc97d63658f5927584bd073942ba053

SHA256
7af6ad94dc99df502aece61da80b7394f4fd44cec7bab9b43adacd7f723bf013

SHA512
86acc0da236344987065f12456097a634b478274fea38ac7cb12a1b5426edcc5fa3d82188964f83d04fe9a792b332f570c794deca34855d7ff300f7041cc7f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\pipiuni.bat

Filesize
144B

MD5
e15e44a1859820fe7b917924cde4a492

SHA1
b7535f140b074a4d95e2c5e44e57aee004a832f9

SHA256
15c980faa0b5beab97c1e1edb62989417118806e3aae0707e4867d786377857c

SHA512
d6c04133d4233fe5da7fc8c962a77170a37b21750683a7a9f5ec92542b7b5a65915f7675ae317d559fc304de6e50622742263c7010f69e33dcaae01b850c18ac

Download Submit
C:\Windows\javalava.dll

Filesize
435KB

MD5
a4fa0c2f34af820e831e064df6f4273f

SHA1
109d5f113ae758a43d99afa7c1e31f5ad0df46e5

SHA256
4b915a2539b8e7fac2a3d4fc561a367f8b7345ef1c89d5eeb99a4b231a6945db

SHA512
956a891dc636247fa04a6e63c6539992ef63842c0604781bcda25c2bbad3260ffa8ef5a8e07b6eea02729ef15a5eb78fa939e41dcf7335d14b409023732a6339

Download Submit
C:\program files\ieworld\ietheword.ini

Filesize
8KB

MD5
7c5c7ef31c01be7dc9aab07197d59052

SHA1
1732f6eab1f5727362bbb25028afd760f777c770

SHA256
bfdb19348faace85b8eb971be8e6329a8defa94b7158bb0b32b274b09494077d

SHA512
0c3c0e648750df08041d555e843599375440c4762ceb2650d73a97868709a326b47c352decd79e5a5b44b604ed3cb28c46f41c8fa6bea9272a9ae0de68d3f5a9

Download Submit
memory/3412-52-0x0000000074840000-0x0000000074868000-memory.dmp

Filesize
160KB

Download
memory/3412-54-0x0000000076830000-0x0000000076DE3000-memory.dmp

Filesize
5.7MB

Download
memory/3412-25-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/3412-24-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/3412-48-0x0000000075F80000-0x0000000075F81000-memory.dmp

Filesize
4KB

Download
memory/3412-15-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/3412-51-0x0000000075EC0000-0x0000000075ED8000-memory.dmp

Filesize
96KB

Download
memory/3412-50-0x0000000077B80000-0x0000000077BE3000-memory.dmp

Filesize
396KB

Download
memory/3412-19-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/3412-53-0x0000000076500000-0x0000000076781000-memory.dmp

Filesize
2.5MB

Download
memory/3412-55-0x0000000077A50000-0x0000000077ACA000-memory.dmp

Filesize
488KB

Download
memory/3412-23-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/3412-57-0x0000000074150000-0x00000000741CF000-memory.dmp

Filesize
508KB

Download
memory/3412-56-0x00000000751B0000-0x0000000075358000-memory.dmp

Filesize
1.7MB

Download
memory/3412-58-0x00000000741D0000-0x0000000074620000-memory.dmp

Filesize
4.3MB

Download
memory/3412-59-0x0000000075F60000-0x0000000076050000-memory.dmp

Filesize
960KB

Download
memory/3412-16-0x0000000075F80000-0x0000000075F81000-memory.dmp

Filesize
4KB

Download
memory/3412-20-0x0000000075F60000-0x0000000076050000-memory.dmp

Filesize
960KB

Download
memory/3632-104-0x0000000000B00000-0x0000000000B72000-memory.dmp

Filesize
456KB

Download
memory/4544-105-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/4544-86-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/4544-47-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads