Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
279f160fa72fc360880bb2200feba630_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
279f160fa72fc360880bb2200feba630_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
279f160fa72fc360880bb2200feba630_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
279f160fa72fc360880bb2200feba630
-
SHA1
d5cec6c53e5b07eec307639b64a83766272e7925
-
SHA256
ac10945174ef4bc81a4103f74b9e54c5fbf2e105a9d65b7eb6c55c8f72494b5b
-
SHA512
06dad3dab5303d54db14ee1147ef86710ccb9ff67938cbab4ba25eb002bf1c3f13f8b65f695116821e5b6c8d1618753ea773fc4bd37861c1dff1ccb8f94eb59a
-
SSDEEP
24576:O33VamN76KK07iWxgspm1PNzxZ5gnrog8aRafukZvuqI8eFLC15wvnPdsqQ4s:OEmN76KK02OqPt5grogpRamuuqI9FLCh
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 2684 kls.exe 1876 ToolbarUpdaterService.exe 1576 ToolbarUpdaterService.exe 1056 ToolbarUpdaterService.exe -
Loads dropped DLL 64 IoCs
pid Process 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2744 regsvr32.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\StartNowToolbarHelper = "\"C:\\Program Files (x86)\\StartNow Toolbar\\ToolbarHelper.exe\"" kls.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}\ = "StartNow Toolbar Helper" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ToolbarUpdaterService.exe -
Drops file in Program Files directory 48 IoCs
description ioc Process File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_amazon.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe kls.exe File created C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_facebook.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_msn.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_shopping.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\reactivate\index.html kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_left.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png kls.exe File opened for modification C:\Program Files (x86)\StartNow Toolbar\uninstall.dat kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\engine_web.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\protect\SearchProtectIcon.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\reactivate\LeftImage.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_hover.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_middle.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_ebay.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_games.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_travel.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\icon_twitter.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_background.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\installer.xml kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\startnow_logo.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\protect\window.js kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_normal.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\protect\NotIE6.css kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\reactivate\OnlyIE6.css kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\reactivate\window.js kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\engine_maps.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\engine_videos.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\protect\index.html kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\reactivate\window.css kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\separator.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\toolbar.xml kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\engine_images.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\images\engine_news.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\protect\OnlyIE6.css kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\protect\window.css kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\reactivate\NotIE6.css kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\chevron_button.png kls.exe File created C:\Program Files (x86)\StartNow Toolbar\Resources\skin\splitter.png kls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ToolbarUpdaterService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ToolbarUpdaterService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ToolbarUpdaterService.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0006000000019c0b-25.dat nsis_installer_1 behavioral1/files/0x0006000000019c0b-25.dat nsis_installer_2 -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{22D5E096-940A-CE47-CCFF-72BC315B9667}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={Language}&form=IE8SSC&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}" kls.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\MonitorHomepageChanges = "0" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{5911488E-9D1E-40ec-8CBB-06B231CC153F} = "StartNow Toolbar" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main kls.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{22D5E096-940A-CE47-CCFF-72BC315B9667} kls.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\lastFFToolbarDisabledTimeH = "31136283" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\lastFFToolbarDisabledTimeL = "1702749232" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\MonitorHomepageChanges = "0" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar ToolbarUpdaterService.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY ToolbarUpdaterService.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000 ToolbarUpdaterService.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software ToolbarUpdaterService.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{22D5E096-940A-CE47-CCFF-72BC315B9667}\FaviconURLFallback = "http://www.bing.com/favicon.ico" kls.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\URLSearchHooks kls.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\MonitorHomepageChanges = "0" ToolbarUpdaterService.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar ToolbarUpdaterService.exe Key deleted \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\URLSEARCHHOOKS kls.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER ToolbarUpdaterService.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar regsvr32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{22D5E096-940A-CE47-CCFF-72BC315B9667}\DisplayName = "Bing" kls.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes kls.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} kls.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\saveFFToolbarDisabledState = "1" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\StartNow Toolbar\MonitorSearchChanges = "0" ToolbarUpdaterService.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Start Page Restore = "http://go.microsoft.com/fwlink/?LinkId=69157" kls.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{22D5E096-940A-CE47-CCFF-72BC315B9667}" kls.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{22D5E096-940A-CE47-CCFF-72BC315B9667}\URL = "http://www.bing.com/search?q={searchTerms}&pc=Z136&form=ZGAIDF&install_date=20241009&iesrc={referrer:source}" kls.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry ToolbarUpdaterService.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.msn.com/?pc=Z136&install_date=20241009" kls.exe -
Modifies data under HKEY_USERS 38 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-36-61-07-cf-2c ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\lastUpdateErrorTimeH = "31136283" ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\Software ToolbarUpdaterService.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ToolbarUpdaterService.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1EAC05C4-E3A0-4562-AE33-B51979D4EF2E}\WpadDecisionTime = 00d30d671b1adb01 ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-36-61-07-cf-2c\WpadDecision = "0" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18 ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1EAC05C4-E3A0-4562-AE33-B51979D4EF2E}\WpadDecision = "0" ToolbarUpdaterService.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-36-61-07-cf-2c\WpadDecisionTime = 00d30d671b1adb01 ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ToolbarUpdaterService.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\MonitorHomepageChanges = "0" ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1EAC05C4-E3A0-4562-AE33-B51979D4EF2E} ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1EAC05C4-E3A0-4562-AE33-B51979D4EF2E}\fe-36-61-07-cf-2c ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\lastUpdateErrorTimeL = "1729419232" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar\MonitorSearchChanges = "0" ToolbarUpdaterService.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f018a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software ToolbarUpdaterService.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1EAC05C4-E3A0-4562-AE33-B51979D4EF2E}\WpadNetworkName = "Network 3" ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\StartNow Toolbar ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ToolbarUpdaterService.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ToolbarUpdaterService.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1EAC05C4-E3A0-4562-AE33-B51979D4EF2E}\WpadDecisionReason = "1" ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft ToolbarUpdaterService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ToolbarUpdaterService.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ToolbarUpdaterService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-36-61-07-cf-2c\WpadDecisionReason = "1" ToolbarUpdaterService.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\ = "ToolbarHelperObject Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\TypeLib = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\Programmable\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\InprocServer32\ = "C:\\Program Files (x86)\\StartNow Toolbar\\Toolbar32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\ProgID = "Toolbar.BandObject.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1\ = "ToolbarHelperObject Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}\ = "Toolbar" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\VersionIndependentProgID = "Toolbar.BandObject" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Toolbar.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\StartNow Toolbar" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\CLSID = "{5911488E-9D1E-40ec-8CBB-06B231CC153F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\ = "Toolbar 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ = "IBandObject" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ = "IBandObject" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\CLSID = "{6E13D095-45C3-4271-9475-F3B48227DD9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\TypeLib = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1\CLSID = "{6E13D095-45C3-4271-9475-F3B48227DD9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject\CurVer = "Toolbar.ToolbarHelperObject.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\ = "{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\ = "IToolbarHelperObject" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}\1.0\0\win32\ = "C:\\Program Files (x86)\\StartNow Toolbar\\Toolbar32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject.1\ = "BandObject Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.BandObject\CurVer = "Toolbar.BandObject.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\ = "StartNow Toolbar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\Programmable\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\InprocServer32\ = "C:\\Program Files (x86)\\StartNow Toolbar\\Toolbar32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}\ = "StartNow Toolbar Helper" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe 2684 kls.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2980 1868 279f160fa72fc360880bb2200feba630_JaffaCakes118.exe 30 PID 2980 wrote to memory of 2684 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 31 PID 2980 wrote to memory of 2684 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 31 PID 2980 wrote to memory of 2684 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 31 PID 2980 wrote to memory of 2684 2980 279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp 31 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1876 2684 kls.exe 32 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 1576 2684 kls.exe 33 PID 2684 wrote to memory of 2744 2684 kls.exe 34 PID 2684 wrote to memory of 2744 2684 kls.exe 34 PID 2684 wrote to memory of 2744 2684 kls.exe 34 PID 2684 wrote to memory of 2744 2684 kls.exe 34 PID 2684 wrote to memory of 2744 2684 kls.exe 34 PID 2684 wrote to memory of 2744 2684 kls.exe 34 PID 2684 wrote to memory of 2744 2684 kls.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\279f160fa72fc360880bb2200feba630_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\279f160fa72fc360880bb2200feba630_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\is-EOKLP.tmp\279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-EOKLP.tmp\279f160fa72fc360880bb2200feba630_JaffaCakes118.tmp" /SL5="$4010A,1225093,54272,C:\Users\Admin\AppData\Local\Temp\279f160fa72fc360880bb2200feba630_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\is-O6JO5.tmp\kls.exe"C:\Users\Admin\AppData\Local\Temp\is-O6JO5.tmp\kls.exe" /TOOLBAR /DEFAULTSTART /DEFAULTSEARCH /CHANNEL="310"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --install4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1876
-
-
C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe" --start4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1576
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /i /s "C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:2744
-
-
-
-
C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"C:\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
PID:1056
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5335399cdd3d87a3e9bd273d0a4cef7a7
SHA18a69758a49ee99b9633cbabd9cffce9cf34330c6
SHA256eec73880d51ff9b990225b1aa52ebdeabae742ec25080c530f0c5b410a818ce8
SHA512d5d02b9bfb82098179811174b45a52497d8d20be8eaf749cfd4a1af88e0839c51524c86f673a03410a2f4493f205ea6002bc178045d748625933b1de78e98f0a
-
Filesize
5KB
MD5708a8b8ee1337d1c7e7875efe7177225
SHA100622b26a870d228d9699aba832da61b4acfa6fc
SHA256a902339763d62723288abcac8fdc53108960144aaa93fb305afd4d326f6184e2
SHA5120efd3e675bab299636f28cfa98bfc78a3b281a7168d74ae04c8627c0e0413cc8a44a769d2aff7de59154a5860eb92ad347953cde2a9c9aef537d1d07399d8a6f
-
Filesize
490KB
MD5264e17157f8ab689420036788be89fae
SHA13729386258b989c278c37dcd600bca349fb4057c
SHA256e817bc723227e62eebc20ed9b8e51a553d2994c60a43f116cec92cfa9ef59a7d
SHA512d56575b597e8f0bfb6390126768abc0912a21c9c041101314cf28c2e57f0fa73cb83f6a15f2533dce9237a88ac60a616eca4d14fb21e13b4a3ef40e40ea6ae70
-
Filesize
261KB
MD57ccf424450af71461ca5aca14fb45b72
SHA1f40d32cc5fb2cd3466e3d28becdf178386092048
SHA256faba02d8276bb39b7424601005583318eb697a49dde79b26f795e89dffda3a23
SHA512553ebbd0d818d645b94139f52f22773cb1cdc1b206845c449ab7ac489b57ee92fb2add31b00aac0dfb57f3f90ba1c0c1756c43715fe2c2d5ac938ffe49c6954b
-
Filesize
244B
MD5f3b1e3a55e8de1ddfc24db7717dbcd5e
SHA1679978857b86e5a1c5e2ab6c21d9c3a02f88b99f
SHA256aa5973cddd5d048ecc5d5710abac71287b594eccad7809d44c6665aacc75a5a4
SHA512a533ccf92e0f54e7ba3c37fd40f268c2d02f46a8d3536b8a4e1a5d375010bdfbc69f531ff0f14cf300a44b6cd98cf0aff19f29e05f5a7066140a3492bcd17794
-
Filesize
6KB
MD58450b29ee8d592c208ba1aaf6ee50267
SHA175096da057bc85cef63bb0eec168652ea75cf618
SHA25653aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
SHA512d23a3057053a1f36f5eb212ae0b09b9b0b41e50b8a6a20bbc46c12c51199ad0bca741bcce17534488158e8f2b9470dbdac2aa059688b7588a05778c40d461039
-
Filesize
696KB
MD58aa8c628f7b7b7f3e96eff00557bd0bf
SHA19af9cf61707cbba7bf0d7cbed94e8db91aff8bd6
SHA25614d4fa3ea6c3fbf6e9d284de717e73a1ebb5e77f3d5c8c98808e40ade359ea9d
SHA5125e0a4765873684fce159af81310e37b6918c923ccede0c4de0bd1e2e221425109131830cff02e3f910f15b0401ee3b4ae68700b6d29a5e8466f6d4ee1dcd6eeb
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
712KB
MD5b14e34c63e05fd86a22cca5eaba471f9
SHA17dab4ffc80a3f58cdfe2bb8e82612fa44f6b58ce
SHA25603fc36f8a5612472d392ea602c40a9199fcbbdba670102b1a61b50e5a76128da
SHA512b5be22c575d78eb3acbd18a51d558598a5609bb5f601ced94c3337b4eb05c48904807a62ea792eb46d41ca999e837fc2d8dc9d32de1c8d8d3d0cac17b65ef712
-
Filesize
6KB
MD55264f7d6d89d1dc04955cfb391798446
SHA1211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc
SHA2567d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
SHA51280d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7
-
Filesize
20KB
MD5de2b06d8abcd4a1d3330e415ce638a6a
SHA12f1bf738915b288530dedb861f4ea4f60069a91f
SHA2568f62633831a326174f05e89503e42a493aa834fa6d7ba7138d9d57ac5873512d
SHA5128dbc0edb71d6acc327418270b33d5627d7940ce406e54152af9f6c8f6d90c7239aa647a0e1f4769d0aa8bd3e38d60643e6356ff7a5ccf7dc44c5617f72277b70
-
Filesize
66KB
MD5b140459077c7c39be4bef249c2f84535
SHA1c56498241c2ddafb01961596da16d08d1b11cd35
SHA2560598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
SHA512fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
20KB
MD52f94245152dbd233e248909f9c01c578
SHA1ab4e5879c001b36a2f9ff214946599fd015edda9
SHA2564c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
SHA512f92830de27d6663be5e0df9e32cd88732bc7ee93b14c1ded65258c325d22436400801aff1124f40400c6c3b3c16e71deb08436714716f3888d13a8a6b6a32231
-
Filesize
8KB
MD5a7d710e78711d5ab90e4792763241754
SHA1f31cecd926c5d497aba163a17b75975ec34beb13
SHA2569b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
SHA512f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
Filesize
39KB
MD5d3686f7113ae84568624746249cbec6e
SHA1a5849fd8e5722f91e58eec28244e9d54387f5912
SHA2560d8fc9dc3894ccab669eee7e07c7d53a85ee191069c5e02140a23bc19461ec39
SHA51218dec8ef52c343587e7790bbb4a0eca9a02efd37ca347e2ed72d03c2021486b240c8d451c2d04e1b564c80eee437b4730d53c7702524159291255a15e6de1b6d
-
Filesize
20KB
MD5009dbbdd1ef470dd752c2b73835da3e7
SHA1f97da6556b24302df8201a092eaa32a80d49064b
SHA256c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
SHA512dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5