Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe
-
Size
488KB
-
MD5
4a2be3af52f74b5f5120b8431e5610b8
-
SHA1
397f18e3d2a592bf479d35c82e7a76a5d3391967
-
SHA256
b57fd996f2bcb3d3c09ead04b388a9fc619018985e26be74a65efbb4487462e2
-
SHA512
2eebb9f8f4b041599e4b17156b3fba377b36a2bb08bf0f7b78b503bcc7c34a53cb2fcf3fceb1efb3cdd24e82b00a9f4f24eaeed6caa5f348a4be5d84e54a1448
-
SSDEEP
12288:T33Q9q2bGUVa0eJqj6ACNTuihvSlqP37lCMtB64zg:T3bcGUVZeJWUNTThqIP37lh/fzg
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts aaad.exe -
Executes dropped EXE 3 IoCs
pid Process 2920 aaad.exe 2584 aaad.exe 2652 aaad.exe -
Loads dropped DLL 43 IoCs
pid Process 2816 regsvr32.exe 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 2652 aaad.exe 2764 rundll32.exe 1064 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 1064 rundll32.exe 1064 rundll32.exe 2764 rundll32.exe 1064 rundll32.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe 2652 aaad.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\ = "winhome" regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 aaad.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\70l8.dlltmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0aa3.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0dr0.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03as.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\830e.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\8ado.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0ddd.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File created C:\Windows\SysWOW64\-126-882516 rundll32.exe File created C:\Windows\SysWOW64\1cd rundll32.exe File opened for modification C:\Windows\SysWOW64\da3r.dlltmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aaad.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\8ado.dlltmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\30e6.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\70l8.dll 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\33u6.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dlltmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\aa0d.bmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\0d06.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\733a.flv 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\864.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\4acu.bmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\864d.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\686d.flv 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\64a.bmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\686.flv 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\686d.exe 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\d06d.flv 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File opened for modification C:\Windows\64au.bmp 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe File created C:\Windows\Tasks\ms.job 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\TypeLib\ = "{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\ = "CFunPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\VersionIndependentProgID\ = "BHO.FunPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\ = "CFunPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\TypeLib\ = "{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer\ = "BHO.FunPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\ProgID\ = "BHO.FunPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\ = "CFunPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\TypeLib\ = "{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\ = "IFunPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID\ = "{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9A5E127F-4EB8-4E6C-92EA-5C8631054C7D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\8ado.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\ = "IFunPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D8644A6-61C5-4641-A655-31C637BD560C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID\ = "{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84C4A916-2F38-41C4-99BD-C4E8FA05EA54}\InprocServer32\ = "C:\\Windows\\SysWow64\\8ado.dll" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2652 aaad.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 3068 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 31 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2248 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 32 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2104 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 33 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2192 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2816 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 35 PID 2328 wrote to memory of 2920 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 36 PID 2328 wrote to memory of 2920 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 36 PID 2328 wrote to memory of 2920 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 36 PID 2328 wrote to memory of 2920 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 36 PID 2328 wrote to memory of 2584 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 38 PID 2328 wrote to memory of 2584 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 38 PID 2328 wrote to memory of 2584 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 38 PID 2328 wrote to memory of 2584 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 38 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2652 wrote to memory of 1064 2652 aaad.exe 42 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41 PID 2328 wrote to memory of 2764 2328 4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a2be3af52f74b5f5120b8431e5610b8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\70l8.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\03ca.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2248
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\da3r.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2104
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\8ado.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2192
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32\8ado.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2816
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\system32\aaad.exe -i2⤵
- Executes dropped EXE
PID:2920
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\system32\aaad.exe -s2⤵
- Executes dropped EXE
PID:2584
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32\830e.dll, Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\SysWOW64\aaad.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32\830e.dll,Always2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD503e9030cbaf4175994fe67f84b1f155d
SHA1767c1368adae868841650ecf87951d2251bc3c96
SHA2567d274b8adfa036a114a2d34e747b42316c04c388b1f7d83d3c4de50f8b2a8ad1
SHA51294210245c58b71b8237ebc17aa95b7b61bf41cd9ed3aab5cf9b4cfdf88332ee4c0cdc218af354ea6e9392034b9c3c862ca16cb6bacd144f107358bdd2f4a3ea5
-
Filesize
265KB
MD519b3792652d33d6719232035fca1d111
SHA114b676a104d9e8bf889978d599e0a786e2486035
SHA256fb01aeaab52e658cdf929c14f73dec26285b1a2258e852787e712628d12dccac
SHA51218ecbb45591f129351eca106e847f7e5a1ad803b48b069b97b1b09108d4c1de8c16785255ec65a3b974f217c5a3d5307852042d51ed3a10fc7d78fbef75cb835
-
Filesize
64KB
MD51df34f9eff7aef89bec15427fb63f232
SHA16e243da7d8f72ca670f36d337fb5a510074d1c13
SHA256f401573e17067a7036e352fd4d6c6bec831f31c4c4d5cc0313f9ec9406136c59
SHA512daedbf20868a531062418d30a865e82e63b7ddb1b87a27c89143e954f01659856d83101bd3fae43f1059c8e436e051b81c125249d4ad1a85c4b0d62c5530899b