Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
3fbbc4076a45bfbe08334c587cc5a190
-
SHA1
1855d84f967d46fe79877a59040eede7083fc0aa
-
SHA256
9dd0c3e5e7eda5f6c5caf3128fbc5b5e9c24a8de165e526b2618b4fbd5461bc8
-
SHA512
48f7f14de94ad99be65997066faa67d48d20c41a6b620e7311a513e116d91ee2e5da38a174237cd234bbc1eed1d457683ef9c94fb931fe2150826bfa6cccc2af
-
SSDEEP
98304:8g6t0F4NvE79tc0QIBl8j2fUi/QsGG+pWIGE15L0qqdhF:8vycA9NBl8SfmsR6KqQF
Malware Config
Signatures
-
Executes dropped EXE 16 IoCs
pid Process 2780 Uninstall.exe 2776 SangforCSClientInstaller.exe 2144 SuperExeInstaller.exe 1320 SuperServiceInstaller.exe 2104 SangforPromoteService.exe 3044 SangforServiceClientInstaller.exe 2440 InstallControl.exe 2992 VNICInstaller_X64.exe 2116 DNSBackup.exe 2320 Installer.exe 1176 DNSBackup.exe 1592 HTPInstaller.exe 672 SangforSDUIInstaller.exe 988 SJobberInstaller.exe 2272 SangforUpdateInstaller.exe 2844 SangforRAppInstaller.exe -
Loads dropped DLL 64 IoCs
pid Process 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2780 Uninstall.exe 2780 Uninstall.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2776 SangforCSClientInstaller.exe 2776 SangforCSClientInstaller.exe 2776 SangforCSClientInstaller.exe 2776 SangforCSClientInstaller.exe 2776 SangforCSClientInstaller.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2144 SuperExeInstaller.exe 2144 SuperExeInstaller.exe 2144 SuperExeInstaller.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 1320 SuperServiceInstaller.exe 2104 SangforPromoteService.exe 1320 SuperServiceInstaller.exe 2104 SangforPromoteService.exe 2104 SangforPromoteService.exe 2104 SangforPromoteService.exe 2104 SangforPromoteService.exe 2104 SangforPromoteService.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 3044 SangforServiceClientInstaller.exe 3044 SangforServiceClientInstaller.exe 3044 SangforServiceClientInstaller.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2440 InstallControl.exe 2440 InstallControl.exe 2440 InstallControl.exe 2440 InstallControl.exe 2440 InstallControl.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 2992 VNICInstaller_X64.exe 2992 VNICInstaller_X64.exe 2992 VNICInstaller_X64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FFD2FD1F-C991-4A2F-8557-CDB11E275000} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E39B98A8-34A7-4D92-A979-920C48815003} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E39B98A8-34A7-4D92-A979-920C48815003}\ = "SangforSSO" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E39B98A8-34A7-4D92-A979-920C48815003}\NoExplorer = "1" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\SET5EB.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\SET5EB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\SangforVnic.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233} DrvInst.exe File created C:\Windows\SysWOW64\detoured.dll InstallControl.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\SET5EA.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\SET5EA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\sangforvnic.inf DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Sangfor\SSL\HTP\zbcdll.dll HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\uninst.exe HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforL3Vpn.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\Promote\PromoteUninstall.exe SuperExeInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\Uninstaller.exe SangforRAppInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVNIC.inf VNICInstaller_X64.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\msrdp.ocx SangforRAppInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_MOD.dll InstallControl.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\Uninstaller.exe VNICInstaller_X64.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\DNSBackup.exe VNICInstaller_X64.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\HTP\htp.dll HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe SuperServiceInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\VnicDriverSign.dll VNICInstaller_X64.exe File created C:\Program Files (x86)\Sangfor\SSL\SvpnJobber\SvpnJobber.exe SJobberInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSddn.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSDUIInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\DC.bat VNICInstaller_X64.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\SfRemoteAppClientHook.dll SangforRAppInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\nd_dkey_v2.CAB 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforUpdate\Uninstaller.exe SangforUpdateInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\CSClientManagerPrj.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClientUninstaller.exe SangforCSClientInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforSDUI\SangforSD.dll InstallControl.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\HTP\htpd.exe HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\epsnd_m8.inf InstallControl.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\krtdll.dll HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforSDUI\SangforSDUIUninstaller.exe SangforSDUIInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SvpnJobber\SJobberUninstaller.exe SJobberInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\htpd.exe HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforSDUI\SangforSDUI.exe SangforSDUIInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_SC.dll InstallControl.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\mstscax.dll SangforRAppInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSD.CAB 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\uninst.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\htp.conf HTPInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe SangforCSClientInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\CSClientManagerPrj.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\detoured.CAB 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\Installer.exe VNICInstaller_X64.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforBHO.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSddn.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforBHO.dll 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\HTP\krtdll.dll HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\Promote\msvcp60.dll SuperExeInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforUpdate\SangforUD.exe SangforUpdateInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.app.log Installer.exe File opened for modification C:\Windows\INF\setupapi.dev.log Installer.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SuperServiceInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNSBackup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SangforSDUIInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SangforRAppInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SangforCSClientInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SuperExeInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SangforUpdateInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNICInstaller_X64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNSBackup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SangforServiceClientInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTPInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJobberInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SangforPromoteService.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x000500000001960c-185.dat nsis_installer_2 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforIEBHO\CurVer 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4E83E24C-7C6F-4E7F-BC90-DDDC3E8E6B5F}\ = "ISSOClientBHO" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5A85624-037B-446E-9090-EEA49DFD4300}\Implemented Categories 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91557551-9285-4884-B882-DD419F1A7590}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E532BD84-B91B-482D-9575-E6B8534802B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4BC93A23-F692-4D82-8C9B-D26232C8FFD3}\ = "Sddn Class" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4BC93A23-F692-4D82-8C9B-D26232C8FFD3}\VersionIndependentProgID\ = "SangforSddn.Sddn" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{915C2B11-A583-429F-821A-477CE5277C76}\ = "ICSClientManager" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforIEBHO 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E83E24C-7C6F-4E7F-BC90-DDDC3E8E6B5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70AED526-A803-4E5D-9EFC-BDA40D039502}\1.0\ = "SangforL3Vpn 1.0 Type Library" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F1FA1B-468A-41E3-BBC8-4FF781015C4F}\TypeLib\Version = "1.0" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92C38A7D-241A-418C-9936-099872C9AF20}\TypeLib SangforRAppInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235}\1.0\0 InstallControl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D257CF85-8E97-4C9B-8407-459B28005010}\VersionIndependentProgID\ = "CSClientManagerPrj.CSClientManager" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A39CB63-CC0C-4EDD-82D0-4559C5085003}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClientNSPPrj.ClientNSP\CurVer 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProxyIE.CSProxy\CLSID\ = "{53EC2F48-968E-4A42-B99B-9F6571475003}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53EC2F48-968E-4A42-B99B-9F6571475003}\ProgID 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91557551-9285-4884-B882-DD419F1A7590}\TypeLib\Version = "1.0" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F1FA1B-468A-41E3-BBC8-4FF781015C4F} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{915C2B11-A583-429F-821A-477CE5277C76}\ProxyStubClsid32 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B98A8-34A7-4D92-A979-920C48815003} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5A85624-037B-446E-9090-EEA49DFD4300}\InprocServer32\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\SangforNsp.dll" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53EC2F48-968E-4A42-B99B-9F6571475003}\InprocServer32 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F1FA1B-468A-41E3-BBC8-4FF781015C4F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforHelper.1\ = "SangforHelper Class" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.SSOClientBHO.1\CLSID 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.SSOHtmlElementEvent.1\CLSID 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235}\1.0\ = "FT_ND_SC 1.0 Type Library" InstallControl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{915C2B11-A583-429F-821A-477CE5277C76}\TypeLib\Version = "1.0" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB568827-4E19-4131-942E-C960AD93C28A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B57D701-FC61-4857-B172-7135C1917FB1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7CB39B1-4D52-4C1F-A3DB-2EE39B9BB49A} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CA932284-5078-424D-9F64-33283B6F79B5}\TypeLib\ = "{42EB629C-F90C-4192-BCDB-A5E8D85E0106}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235} InstallControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CA932284-5078-424D-9F64-33283B6F79B5} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B98A8-34A7-4D92-A979-920C48815003}\InprocServer32\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\SSOClientPrj.dll" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DefaultParser.DataParser.1\ = "CDataParser Object" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D372A52D-D08B-4336-B561-E00028877FAB} InstallControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A1230203-D6A7-11D8-B9FD-000BDBD1F198}\ProxyStubClsid32 SangforRAppInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B57D701-FC61-4857-B172-7135C1917FB1}\TypeLib 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFD2FD1F-C991-4A2F-8557-CDB11E275000}\Programmable 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A39CB63-CC0C-4EDD-82D0-4559C5085003}\InprocServer32 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8926450F-FECD-4852-9219-F5B4362C94F1}\1.0\FLAGS 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforCore.SangforCoreCom.1\CLSID\ = "{E0F6E061-5558-438D-9FA2-F75503950011}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1465DEB2-3910-4187-967A-2CB6E8925000}\InprocServer32\ThreadingModel = "Apartment" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.SSOClientBHO\ = "SSOClientBHO Class" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.SSOHtmlElementEvent 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A3E8532E-398D-426F-96AC-B7AB9029A354}\1.0\FLAGS\ = "0" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F1FA1B-468A-41E3-BBC8-4FF781015C4F}\TypeLib\ = "{9A2AB65E-3650-4120-AD55-3640EF1716DD}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{400A754D-7867-4BE7-B787-D3F442307577}\1.0\0\win32 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforSddn.Sddn.1\CLSID 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DefaultParser.DataParser\CurVer 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92C38A7D-241A-418C-9936-099872C9AF20}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SangforRAppInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1465DEB2-3910-4187-967A-2CB6E8925000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91557551-9285-4884-B882-DD419F1A7590}\TypeLib\ = "{400A754D-7867-4BE7-B787-D3F442307577}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FT_ND_SC.ePsM8SC.1\CLSID\ = "{0272DA76-96FB-449E-8298-178876E0EA89}" InstallControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager.1\CLSID 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.Web2Client.1\CLSID 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00636D5E-8A83-46D4-A389-7DF7B030B6EC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5A85624-037B-446E-9090-EEA49DFD4300}\InprocServer32\ThreadingModel = "Apartment" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforSddn.Sddn.1\CLSID\ = "{4BC93A23-F692-4D82-8C9B-D26232C8FFD3}" 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 2780 Uninstall.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 2320 Installer.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1896 DrvInst.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeRestorePrivilege 1492 rundll32.exe Token: SeLoadDriverPrivilege 2320 Installer.exe Token: SeLoadDriverPrivilege 2320 Installer.exe Token: SeLoadDriverPrivilege 2320 Installer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2780 Uninstall.exe 2780 Uninstall.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2780 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 29 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2776 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 2144 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 31 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 1320 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 32 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 3044 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 34 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2440 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 35 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2380 wrote to memory of 2992 2380 3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe 36 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2992 wrote to memory of 2116 2992 VNICInstaller_X64.exe 37 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2116 wrote to memory of 376 2116 DNSBackup.exe 38 PID 2992 wrote to memory of 2320 2992 VNICInstaller_X64.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3fbbc4076a45bfbe08334c587cc5a190_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2780
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2144
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3044
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2440
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\DNSBackup.exe"C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\DNSBackup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.execmd /c DC.bat4⤵
- System Location Discovery: System Language Discovery
PID:376 -
C:\Windows\SysWOW64\netsh.exenetsh interface ip show DNS5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2220
-
-
-
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\Installer.exe"C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\Installer.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\DNSBackup.exe"C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\DNSBackup.exe" r3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" interface ip set dns name="Local Area Connection" source=static addr=8.8.8.8 register=PRIMARY4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2556
-
-
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1592
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSDUIInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSDUIInstaller.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:672
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:988
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2844
-
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2104
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{692d7bec-bc6f-07b2-2ada-9911b4e8f36b}\sangforvnic.inf" "9" "693d7628f" "00000000000004D4" "WinSta0\Default" "00000000000003D4" "208" "c:\program files (x86)\sangfor\ssl\csclient\vnic"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1896 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{0c6094d4-1591-483d-2d96-ae00eafa3656} Global\{450fa818-94fe-1d95-1a63-fe30fe94951d} C:\Windows\System32\DriverStore\Temp\{43ada67c-8992-69fd-5105-800b01495233}\sangforvnic.inf2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "3" "201" "ROOT\NET\0000" "" "" "693d7628f" "00000000000004D4" "00000000000003C0" "0000000000000570"1⤵
- Drops file in Windows directory
PID:2196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{9b5d204b-1463-436a-8794-4c24b7e3ea32} "(null)"1⤵PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD599ccd377eff2eb85e43aaadb29ed51b0
SHA15c87d3f53c6376361369e733b534c2c7adf3835b
SHA256b2315499dcbfed9373a169ed2728ffa69847e3ddc8ce24db71387b67a8e5ba9e
SHA512c72ee5df6ca7f2bb798a34c6a8ad00535ef7daed57bb8ea90635dd81b645c5e3b6f853791f990938813cfa3902173ecc6be1cb852c51a8b6d5f1a6072ada7194
-
Filesize
404KB
MD559a6413fb2cc89fd8651b1d2962fb8b9
SHA17e118606f03a591897e014b7693d64e6a86fdbe0
SHA256fed76003f544525783796a22a07b190a8340874c11b5cf1999196c697d51e154
SHA51283e7ea9905214081793c2a241b776a29dab58ba6ce279ceb3851347004c4ae99cf33fb77f12c7d7474de32d417686f8ba5624a7bd7cec73f3dcab55adae307b5
-
Filesize
68KB
MD5ce82406735b89b6e77db305a562705f7
SHA1f22bad486472cd70bf33fbb5c7ada5883b83e8b9
SHA25655001f1fb7437242dafa00cc677d0fc0ed0e88acc36297d467e996967442cc75
SHA512dbfc77243dd12315e74d58eccab2e80f3442fbaa4f0715a9fb11bd300c20acc113ab19b52453607f48624716c92a818f95b1a4112a23e121c92697ea3b2a51f9
-
Filesize
108KB
MD5085e35e80fe658b626ee3bebb0536766
SHA1cc372b471eb98e2fda09577c601aa5668cf4900c
SHA2565e7899ca27f4e955da380a60ef08c14ea396a959f8a7580c116a9f5c62c68f69
SHA512e1724fb9ed3ad25a17ac189a3c0a9bbd13496b4eb2dba1078485ca618230b83410591391b0fa17d9a55391b6dde8534b25c7695083fd63825535aaf944453f53
-
Filesize
34KB
MD54cb8a3a75fb92c341dc3acd7e141b19c
SHA1007691c22828ffd21e0ce5d5fe62922957a434e7
SHA2566561a79476ced5c71c045e4ae92eb5994dc08eea88e37a6ec2abc8c0779f7e89
SHA512243739e0ebc7e57e30bea6b4a44ae2471de858d344f311e991cd04aa29a54a10d32eaeb1ce4fbb14ed4fe85f6164cdc981e58d67b9615c0a992871377b1daa2c
-
Filesize
1KB
MD5807902cec10d074a89232c545f90b6f9
SHA172fc3a4c90b909aa2cca98c007f70f6492511cad
SHA25634aae18c44b7b65cebd2844da1514de208f514f6a839167fde5bb359217af73d
SHA512af86f1a3ee7a48c3cd6bc285de16163b5bb7d2fc560569649c8c5ee67ad00b208e5d02c55ac2b7a9ad135f43f58e305c1d9e7da0f59c143ac644b5e3bfd385aa
-
Filesize
33KB
MD5b87bd17c6d3ab4a5d2621bbf71e9aaf9
SHA1f2139aed3bd315f207598184fbc028353bbd6f7c
SHA2564721d26fe98629324b9eb6ddbafb4991ebec2d64dd0b79fa16b9cee24ca5c20d
SHA512f48607afc6046a275bd3e8de30f54e7a7b08fbb0577fc8aa550b41f127f7a6af62bfdd89216f436114ba739345b0e85cb750bee205b39e2fe5e6b220a6c56cdd
-
Filesize
236KB
MD504055853152f3d3631cf5ce3ec4dbf66
SHA11a30d2f87e572b970ad5bb06aab3c873b15b74a7
SHA256005a236b692e4b3ac220a06f5cfda63417895c6c4c3b387a9269b8ca966a5e3e
SHA51297a16e1c5e774755792cc1356296d83e1bada24f0b6707ad82b0d365adc69bcb15a68fb387be3d7ea3ee751fad601a5e3c3ab4a7e730a590cb514ec20091429e
-
Filesize
144KB
MD5d0bdb0ef0cdc5fcb31fb6799d59e59b2
SHA1f502b98b89c4dbfad14db1156a31de05461aea2f
SHA256d2d17f1c405979ecd5f24106450f5c70f268743ab6cf6f3610aea6d9e260c08c
SHA512862a5def9403964ab5ed10d6a1161d06494922a83b6f76eb3f44c320a5be9679c269922b16b27f032da7860cf9099037f3b9a8a94f81e8f318e4436ebebb86a5
-
Filesize
100KB
MD557dc36976b7bc55a37109695f3d1d499
SHA1f55e66329b3b691a1c393f0cda81328cf16bdc57
SHA25603676c9e0a0e59ab0b8e0a20a92cb000cf657ad5c64c86ad4d2e6660996e0da4
SHA512fc2e4d81d3ba4cdc96844337d62df8566b09dc5e8643f828b6f57f8a9930f978ce3954df65c14dab9d48a5c9da909f3c0bd0f1b4f327d0da4f9086573f58cbb0
-
Filesize
227KB
MD5ad8a0eeaee0a600f80dc3ee1b24d92ec
SHA1825795549bd36254313488eff8185b725b81cdf1
SHA256fde38773cbb182ac7f5b18a2439c2c7e9e420485b48e5ab80108e064201fd5f6
SHA512a3035ea638232771570f7c16253a63bbd5bec00a8f6583d3e0155ebe40c076df166157503be6f0c76a77b17ff0acfed38c312d205472542422c7317396176842
-
Filesize
596KB
MD584c4796caacc1eca8b5e739f900fdfac
SHA1ff33d1a58ba1a32b132444e970e6dd704d82c2ea
SHA2560da9fddb51c610c98aa098c2a9460b80a89e41b1c05be54a85f4082a46b855c6
SHA5121bedaa428d9686b30745f9a7f7feec8f011e522b2f173aa51e54b1cca1c800f8233c669a300726b12b2c7e50065ff756c0c2e7619018e37c2bd6404d7241363a
-
Filesize
276KB
MD571946aaed78cbfa3758eac844dfa7837
SHA1a4cc9443352db832c0977339650d99d635225b07
SHA256309d314886106ec5c9b276a0c28a1bf2985e27f5ce4c68c43195f45171dc070f
SHA512de843d5f175aeb876e2c732c9051c572b3fd46a880a7745a237d45eac2e82481552b37c2732bdbbcc0e8052d299fa81b6d7e069bbcee1ea777057c1cafd449ba
-
Filesize
1.4MB
MD5adb61575e9f50a62dc8d03f3fbe3b9a2
SHA19055667dbb312ee932794cdc7cce7720be246c17
SHA256eae0415bdd3943e7695815798cd55ed27d51a6c8c99427e9dc833f726f2a3f96
SHA512cc4a7f32139887c8e819b073875bfafd351da697edd0c7aa76c00ed5c14b82c70bc2db8bc33b9be6148d25fe2c24819dc9807f2e75d1d9b8787f10f54d6c0458
-
Filesize
249KB
MD50770df7c04942e6fd1a8ebecf21f6916
SHA11320cdc2f41ad63199c56c65af72c17e80b00e2d
SHA256493ff4da2bc74d6c636ca1e3543f5930820fea3a06fd02a737c01a038a501ad3
SHA512d8144b6c1b0d54fbd850cba2e980ba3b5a5d42abe9595e9ad2681ac54a47dce2ca72ba6cf71a98b797b86901fb1011a59a7a7ae3d21c95b2ebb86d670128e4bd
-
Filesize
76KB
MD564c803cba85b21bf20004aa3c7128d48
SHA199e5db910b9e6abcda3e0569a5c738e3ee83e477
SHA2565a5f0b46bde6f2cb5b5bcd87584f15e6efb15ebd4fb57a47155cdec3b74029cb
SHA512ada2c2d8cc930b74364c792bde9a5036387d5aa3ed1e64067248861e51133e0d0b48d2ebe90e12ab632a11335314b64d574d561979ac603c4c20b211b87b820a
-
Filesize
1.6MB
MD5bf05ee3df332861f7a7e6c17b5647720
SHA1f2a93217b37dc4351bfa140c3dedd4c4cd203882
SHA2563591a93f69e8b2f6e462d52dbe99a4295c179984c1b36bd43c6d015eaa779949
SHA5125e79169c5e4a5b24a29c8fe2c511ff642b49fb37ebacb2b63aff8e2b19eb84a139c0a78b7388559401ae1f21312ba074e50b357a24b7a55f50a1bd2cd55401dd
-
Filesize
151KB
MD5cc64684253944ed963252354051feb55
SHA161e953dc18b5ddffa4826c18b946b716b927afaf
SHA25615dba1227ddec28002333beccc2fc2e0b823907f012d56d29a9ddcdf8a2759c7
SHA5129b919b5256fb149144b6b90ecdcb7e1814295163e72b2c623e2044993a9f8859923e00a29809b47fd6336fb25575f34c15b7d8f04abf61579ebe2c357202696c
-
Filesize
94KB
MD583cec4b986a07baaebceefe885aaaae3
SHA148729bfbdbe8b612d1c5c5b4a47eefabe8ba7479
SHA256440345ae2effff2b373683a944aade7461dabe495432f926bd42f48d4ff27c6b
SHA51264ef1ae86099a5d772c57b46bba96ee3e10cf7e258d0b8d74d4278b90c8b44c9d5d14220c904a7a20bf49ba795fdb56e22b05499cec30ed384105604ff654cc0
-
Filesize
112KB
MD565afc0dedccde336b0e32ea633b962fb
SHA187451f5045da81f2b20a02c4b4b2a0b51f770858
SHA2565e82edaa5837ebe0eb7ef6b3af8409c75426600ebffd4ccd1366d145a7152237
SHA512d5f55b95cadf8d8f0f9289b429db1d8e2699d4513574c9c611855afac9b8fdac82cff6c9f4020be3c46bbabdc45eb1f170df157d98bc40389a01b583f47e22ae
-
Filesize
124KB
MD5c2aea24fe072430f5606889f4b0ec8e0
SHA16aa6c8356dfee1a0593d3ed858fdd9027bc2e690
SHA256abbd0f4b56997a1961e682604008ae6966d6545231cf6f39b964d0f6abb8a472
SHA5120b5bfebf258008eb854a206719febd468df072104d58e0753342eec9d44c9050e68b9bcf1daaef84e7d0a7b677c667ecc617a20d5299f78f4ecf372fa278e974
-
Filesize
576KB
MD5bf33dfa4bd0fe7b6aa528ed0caff9bb4
SHA1b97b5528749ea41e371449ba501cdd4d2a922322
SHA256c5dd3eee31e62b9f2740a9956f2406a6d078eb90afed56cc6116eca8274eb593
SHA512c711929b08ee8f16cfe27cc68e15097e37a638cf83a039b5cdb0c81caa65a949e8d331d799e049c4a99e36a2e3eb5768060cce4d54553726af585d925270bb70
-
Filesize
10KB
MD5725145e8caa39635cab9899c47c72eda
SHA130478c907551bd920bf359638b091fc5c10b5a53
SHA2561759e4f7777fb8c9ed356a7d4dc237a90e0760061685d44ea02d40ca9e359ceb
SHA512de31286ea10321f762a3b6e7c6c82177d5b6f45a82adc936fcbbc23105708cbbbec903ba94ba94e7723e80f1828393e5395ef575b37136b19de7535e74e24547