4458db20eae5b73025267cc6b0b6d92ca75df40c87583d917a2ed20949b771b7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
Size

689KB
MD5

38d0d2e8cdb2134dc0bc1fc9dc49415e
SHA1

418db449b0948e95888dd8bc56660e3a9c6b5a48
SHA256

4458db20eae5b73025267cc6b0b6d92ca75df40c87583d917a2ed20949b771b7
SHA512

9dabeec82da1bd1bb16fffdef5e179bf4e696d17ab7993bc525a178276f9ccc0a80c859863179754294a9fd3213ef2b449282b42d2efaea635d41c24b7755d57
SSDEEP

12288:gPq1T4LghMpDwBG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDPjeKuVGv/9+N8OLm:gPq1mqMlwBG4G37tUnvone83Z76bMHxx

Score

7^/10

adware discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 5 IoCs

pid	Process
2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
2556	regsvr32.exe
2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
2880	regsvr32.exe
2208	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\ = "TrustMediaViewerV1alpha2485"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\ = "TrustMediaViewerV1alpha2485"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome.manifest	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\install.rdf	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\icons	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\icons\Thumbs.db	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\icons\default\TrustMediaViewerV1alpha2485_32.png	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\icons\default\TrustMediaViewerV1alpha2485_32.png	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ch\TrustMediaViewerV1alpha2485.crx	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome.manifest	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\ffTrustMediaViewerV1alpha2485.js	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\ffTrustMediaViewerV1alpha2485.js	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\uninstall.exe	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485.dll	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\install.rdf	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\ffTrustMediaViewerV1alpha2485ffaction.js	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\overlay.xul	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485x64.dll	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ch\TrustMediaViewerV1alpha2485.crx	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File created	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\ffTrustMediaViewerV1alpha2485ffaction.js	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\overlay.xul	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\icons\Thumbs.db	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ff\chrome\content\icons\default	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpupdate.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Approved Extensions	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f} = 51667a6c4c1d3b1bec088e5aad67e60c8aca87f063356710	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\ = "ITrustMediaViewerV1alpha2485BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\ = "Trust Media Viewer"	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\ = "ITrustMediaViewerV1alpha2485BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\TypeLib\ = "{eb28f7db-1262-40a0-89fa-f9063febe5d4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha2485\\ie"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\TypeLib\ = "{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\ = "TrustMediaViewerV1alpha2485"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha2485\\ie\\TrustMediaViewerV1alpha2485.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\TypeLib\ = "{eb28f7db-1262-40a0-89fa-f9063febe5d4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\TypeLib\ = "{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha2485\\ie\\TrustMediaViewerV1alpha2485x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\ = "TrustMediaViewerV1alpha2485"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha2485\\ie\\TrustMediaViewerV1alpha2485x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB28F7DB-1262-40A0-89FA-F9063FEBE5D4}\1.1\ = "TrustMediaViewerV1alpha2485Lib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha2485\\ie\\TrustMediaViewerV1alpha2485.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{574A8462-6F26-4C63-809A-0284CE3A8832}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4a9e15fc-3c9a-4589-97c0-c7b0617e200f}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2556	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2124 wrote to memory of 2880	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	32
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2880 wrote to memory of 2208	2880	regsvr32.exe	33
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34
PID 2124 wrote to memory of 2724	2124	38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38d0d2e8cdb2134dc0bc1fc9dc49415e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485.dll" /s
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2556
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485x64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485x64.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies registry class
    PID:2208
- C:\Windows\SysWOW64\gpupdate.exe
  "C:\Windows\System32\gpupdate.exe" /force
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485.dll

Filesize
85KB

MD5
b5c16621f1b64d8710a522fb8bcfba34

SHA1
7b3b14f227da46e0d77c5d42774100451c2ff8f9

SHA256
7968008c61d60540b54375abf264cb799e33c16956aa58687be819e6632c6ef1

SHA512
f852e7728dceb4f73229c3a522c1f4aea40e895b01a7cf0785b0628c05c33cd66f83b70bc0ab1df8a8185814ea7d0a876217ad432cb35aa2cd7ea5bcec859986

Download Submit
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha2485\ie\TrustMediaViewerV1alpha2485x64.dll

Filesize
100KB

MD5
2fd3d8f41f611683e2987a3950d896e9

SHA1
f66b32127d20da0a6730f825baa4c7925a16ccd2

SHA256
fa31c6af0e68198b9419c5ade9456e7190780f5f585be9065c0cd5084f06eb52

SHA512
56e89145b29fdfa99572fae17bda6f58255f9eed09a4daa9d17f9ad178c67f3b47c3d96b1da30a5bb71272b6d7524ce2a5a027481f8656eff8cc3e3d0cd4de91

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBF1C.tmp\aminsis.dll

Filesize
567KB

MD5
f346047b13f37f79c462e59a6319faa1

SHA1
ce9e7cb9719000a69b463fe024c81229e322279f

SHA256
e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453

SHA512
429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBF1C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit