fce9b30752eedfa982de6dd9ae7cffd4eee6d41a9b33f5bed9753dbdea33c467

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
Size

689KB
MD5

04bc37f3697500001fb8f803598b6a3c
SHA1

db8689fc4aa0560af72e5f53eea919fa4b0890c0
SHA256

fce9b30752eedfa982de6dd9ae7cffd4eee6d41a9b33f5bed9753dbdea33c467
SHA512

76d5b41aead82dc2d309e6b14945694396698a645192a374e74d10d46d503148a96c7472c1ab6cb64410d5988a766822fb4ab45d251db04fa03113d4d58fe1b5
SSDEEP

12288:tvirW/GHd5G4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDOjeKuVIvLr+N8SLwwiff:tn+Hd5G4G37tUnvone83Z76bMHxStUIP

Score

7^/10

adware discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 5 IoCs

pid	Process
2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
1060	regsvr32.exe
2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
2700	regsvr32.exe
2792	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8540f286-a005-4e3a-bbf9-569a8c9372c4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\ = "TrustMediaViewerV1alpha3766"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8540f286-a005-4e3a-bbf9-569a8c9372c4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\ = "TrustMediaViewerV1alpha3766"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\GroupPolicy	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\ffTrustMediaViewerV1alpha3766.js	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\ffTrustMediaViewerV1alpha3766ffaction.js	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\icons\default\TrustMediaViewerV1alpha3766_32.png	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766x64.dll	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome.manifest	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\overlay.xul	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\icons	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\icons\default\TrustMediaViewerV1alpha3766_32.png	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ch\TrustMediaViewerV1alpha3766.crx	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ch\TrustMediaViewerV1alpha3766.crx	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\ffTrustMediaViewerV1alpha3766ffaction.js	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome.manifest	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\install.rdf	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\overlay.xul	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\icons\Thumbs.db	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\icons\Thumbs.db	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\icons\default	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\uninstall.exe	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766.dll	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\install.rdf	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ff\chrome\content\ffTrustMediaViewerV1alpha3766.js	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Approved Extensions	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{8540f286-a005-4e3a-bbf9-569a8c9372c4} = 51667a6c4c1d3b1b96ef579933fb550aa4f714da88d231db	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\ = "TrustMediaViewerV1alpha3766Lib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\TypeLib\ = "{37cb03f4-89c6-4458-b00c-57bc864fab30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Version\ = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\TypeLib\ = "{37CB03F4-89C6-4458-B00C-57BC864FAB30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\TypeLib\ = "{37CB03F4-89C6-4458-B00C-57BC864FAB30}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\ = "TrustMediaViewerV1alpha3766"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3766\\ie\\TrustMediaViewerV1alpha3766x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3766\\ie\\TrustMediaViewerV1alpha3766.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\ = "Trust Media Viewer"	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\ = "ITrustMediaViewerV1alpha3766BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\ = "TrustMediaViewerV1alpha3766"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\ = "ITrustMediaViewerV1alpha3766BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\TypeLib\ = "{37cb03f4-89c6-4458-b00c-57bc864fab30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3766\\ie\\TrustMediaViewerV1alpha3766.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37CB03F4-89C6-4458-B00C-57BC864FAB30}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3766\\ie"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C56B353-AEAC-4D09-87AA-75A1AC70BF95}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3766\\ie\\TrustMediaViewerV1alpha3766x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8540f286-a005-4e3a-bbf9-569a8c9372c4}\Implemented Categories	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 1060	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2700	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2700 wrote to memory of 2792	2700	regsvr32.exe	33
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34
PID 2492 wrote to memory of 2676	2492	04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04bc37f3697500001fb8f803598b6a3c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766.dll" /s
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1060
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766x64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766x64.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies registry class
    PID:2792
- C:\Windows\SysWOW64\gpupdate.exe
  "C:\Windows\System32\gpupdate.exe" /force
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766.dll

Filesize
85KB

MD5
2b87b9f4594d9f47826bbee531b027c5

SHA1
922b7f8ddec68c1ed80393654609c1626345a4be

SHA256
1225b91406b737c854df153f8f92c7af579f5ab787f94f18e070d9aee2541fd6

SHA512
63d77821f804e33300d265be4f043da1f76437a85999bac12cae532bffb64b1c4ac931f41c02a0ab1040576d30be7ab1042c2959d75162506d3b8269b9dd0e0d

Download Submit
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3766\ie\TrustMediaViewerV1alpha3766x64.dll

Filesize
100KB

MD5
73dfa827b199612b2a166baf0748b74f

SHA1
ac19c420419175aa8e3fc308f2c0cf7b430277f1

SHA256
eb225486db8bcffaa9628e9610648bf2078322b34e8d60159f90c4a530d629db

SHA512
cef7f21522ffaab808bc768e403d4718be2e722e489d2ec3e8adb06d4743b3c889b8a13766a91cf16fe8c532bf05a32420065c21ac960e29386cdfc0df566738

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9ABA.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9ABA.tmp\aminsis.dll

Filesize
567KB

MD5
f346047b13f37f79c462e59a6319faa1

SHA1
ce9e7cb9719000a69b463fe024c81229e322279f

SHA256
e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453

SHA512
429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167

Download Submit