Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe
-
Size
391KB
-
MD5
2e391c25a113b890b3f4dd5dc81230e5
-
SHA1
61537ea107c566eeae6d1a476e0feac67c2c21d8
-
SHA256
bdbac2f17795626b5f2c7174327e118b212eee9ea7f291113661cf91dd5fb59c
-
SHA512
708a29e55e0e7962b9e039a7e5205210ea689d3dabf36bd43405d96265cfd4a750975ef7a19f4bfe25df9de2da53be9e150f03d84a8433c1f625cd6380825e5a
-
SSDEEP
6144:OY9GYX5o45hdzgdfmgFL1yISqsZXj3vjw7a144ghCgOVXlfYfpdhZacivDgr+C:OhmjvdzJgFkdj3rGro1mWcirgb
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 36bd.exe -
Executes dropped EXE 4 IoCs
pid Process 2992 36bd.exe 2612 36bd.exe 2020 36bd.exe 2024 mtv.exe -
Loads dropped DLL 54 IoCs
pid Process 2092 regsvr32.exe 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 2992 36bd.exe 2992 36bd.exe 2992 36bd.exe 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 2612 36bd.exe 2612 36bd.exe 2612 36bd.exe 2020 36bd.exe 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 2024 mtv.exe 2024 mtv.exe 2024 mtv.exe 536 rundll32.exe 536 rundll32.exe 536 rundll32.exe 536 rundll32.exe 584 rundll32.exe 584 rundll32.exe 584 rundll32.exe 584 rundll32.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe 2020 36bd.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA1B62CC-6D79-4901-B6A2-409F98906E9D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\ regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 36bd.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\3ce8.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\353r.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\SysWOW64\277 rundll32.exe File opened for modification C:\Windows\SysWOW64\4bl4.dlltmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\36ud.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\b33d.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\b33o.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\b3rc.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\c6cb.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\c35s.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File created C:\Windows\SysWOW64\-109-1211067 rundll32.exe File opened for modification C:\Windows\SysWOW64\36be.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\36bd.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\b33o.dlltmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s.exe mtv.exe File opened for modification C:\Windows\SysWOW64\4bl4.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bba6.dll 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\c6cb.dlltmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\353r.dlltmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\436b.flv 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\80a.bmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\480.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\d48.flv 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\0acu.bmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\d48d.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\3cdd.flv 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\b5b3.bmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\cd4d.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File created C:\Windows\Tasks\ms.job 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\cd4u.bmp 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\cd4d.flv 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe File opened for modification C:\Windows\b3cd.exe 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mtv.exe -
Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\TypeLib\ = "{F914606B-7622-4364-9FCA-889F50C497D8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\ = "CFffPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\ProgID\ = "BHO.FffPlayer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\ = "IFffPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID\ = "{BA1B62CC-6D79-4901-B6A2-409F98906E9D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\VersionIndependentProgID\ = "BHO.FffPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\b33o.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\ = "CFffPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\TypeLib\ = "{F914606B-7622-4364-9FCA-889F50C497D8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\TypeLib\ = "{F914606B-7622-4364-9FCA-889F50C497D8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID\ = "{BA1B62CC-6D79-4901-B6A2-409F98906E9D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F914606B-7622-4364-9FCA-889F50C497D8}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\b33o.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer\ = "BHO.FffPlayer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA1B62CC-6D79-4901-B6A2-409F98906E9D}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BFA0DF5-865F-48CC-9D0C-377036D38208}\ = "IFffPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\ = "CFffPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2020 36bd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2024 mtv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2812 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 30 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2792 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 31 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2808 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 32 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2880 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 33 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2092 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 34 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2992 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 35 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2612 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 37 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 1792 wrote to memory of 2024 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 40 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 2020 wrote to memory of 536 2020 36bd.exe 41 PID 1792 wrote to memory of 584 1792 2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e391c25a113b890b3f4dd5dc81230e5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/4bl4.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/c6cb.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/353r.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b33o.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/b33o.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2092
-
-
C:\Windows\SysWOW64\36bd.exeC:\Windows\system32/36bd.exe -i2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2992
-
-
C:\Windows\SysWOW64\36bd.exeC:\Windows\system32/36bd.exe -s2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exeC:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/36be.dll, Always2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:584
-
-
C:\Windows\SysWOW64\36bd.exeC:\Windows\SysWOW64\36bd.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/36be.dll,Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5f4e4aa7a94e1411c7cb0e1e5d52eb1b7
SHA194cb110206ffcc54c830fc77c99ba5acf412b325
SHA256a7ba7ca8ff82a848139674d88d2ca142bf76d9632abfc984478e0c831305f3a7
SHA5121fd76c71869d5870e9fef0a4a8f7580c01ab2f061dba38cc02f58e58d54ec19b7aadf1ab8c393034e5c82abd0adf754cceb9dc594113c1db1d18f86687d1b0c8
-
Filesize
425KB
MD5337c5831d26704628074da5d71550ac6
SHA1fa60ef4505986ef0abce78b7a5553e8b37e8eb2b
SHA25691d1072d527434771213336a48948cdef264e1fabb7d1af987a14842cb8c9621
SHA51201bd751c3d436da3746a1ff6739d5a01446a501da583ff5fc095a5da82d858524f98de00417584c2f81589b152919568ea2300881e45ef5f31bc8e0ed9bb5dbf
-
Filesize
144KB
MD53ba03faeee768eec0fb7ebab8c3ede84
SHA19098cc99395c766487b736b52ca0114ea2d67e82
SHA25659a1f5456aeb7954c13ffcfb096e9aaa61afcabdea4904b4c9e1025fce2e4e3d
SHA5121bcb3a86fcb2388098f4e19083c82d12ed7cabf8a779551c5fc9355881f6bbf4b3d34385d88e5024e7b71aea9a82d169fcce9eebc89b77d0db1c75acd7aeec1f
-
Filesize
136KB
MD586dc6028dd39c64b1681892865b33888
SHA15b11fc34b36e131f31a5fef3c8e320b49963ca98
SHA256fd3eb7acf6bd5eba77d90ea4329aebf6ef5c51a148f167900a251d843fa73d93
SHA512a9205faa705f4667e038c9b0b22321f202bcb10f1264edb3853718c8904c6dc4c21f093cb315f75999374da82f193d3110f9364c8e0ed86d99b41f1a1f4b3263
-
Filesize
104KB
MD5d81cf0de59a7e8e31f69184902622cc4
SHA1badcdb2b96c0145dba5c3207e2d78e9a292863fa
SHA256901c7c8da35c896b70afcca251536fd6ff50f3915c3dfc5e028c2e43e6577c2a
SHA5125570172ebebcc55c29593a828894b153ba16cf787d5b592a1f20636dcb826922674b824b8c46c4f597f2ccc84f68d25135f87ee7a3af5d8dfe039ab48ae4c4c4