Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe
-
Size
600KB
-
MD5
4f4895f86b7a1c708892711e46132e3d
-
SHA1
62a7e6ffd1478d7363105923ef6b99d9a65a5c66
-
SHA256
c5e685dd65228c0237e01b5467333f08b7de33ee15b320b6b21f687b6c8c564a
-
SHA512
55f70b90ebc72df90007c8db3c8033f484a6ff5842be4d3ba2973ffbaddce33fc1d22adb965d424a0887fe257cac7cdec4279f28a757f208b47c711ad714941f
-
SSDEEP
12288:k7l4s3shTJBJbI3HfaiDX29J5FB9i727cgWjaGJkAuR7VUSFNu:kGs3qTZbIXiiX2H5XS27c7ZkvBFNu
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts aaad.exe -
Executes dropped EXE 3 IoCs
pid Process 1944 aaad.exe 1572 aaad.exe 1736 aaad.exe -
Loads dropped DLL 49 IoCs
pid Process 1940 regsvr32.exe 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 1944 aaad.exe 1944 aaad.exe 1944 aaad.exe 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 1572 aaad.exe 1572 aaad.exe 1572 aaad.exe 1736 aaad.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 2860 rundll32.exe 2860 rundll32.exe 2860 rundll32.exe 2860 rundll32.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe 1736 aaad.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "Microsoft User" regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 aaad.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\830e.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\8ado.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0aa3.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File created C:\Windows\SysWOW64\0299 rundll32.exe File opened for modification C:\Windows\SysWOW64\70l8.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\70l8.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0ddd.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\8ado.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File created C:\Windows\SysWOW64\-10889-1992 rundll32.exe File opened for modification C:\Windows\SysWOW64\30e6.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03as.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aaad.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0dr0.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\33u6.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\64a.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\686.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\4acu.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\686d.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\686d.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File created C:\Windows\Tasks\ms.job 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\aa0d.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\0d06.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\733a.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\864.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\d06d.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\64au.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\864d.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID\ = "BHO.FunPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ = "C:\\Windows\\SysWow64\\8ado.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID\ = "BHO.FunPlayer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\ = "CFunPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\ = "CFunPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "CFunPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer\ = "BHO.FunPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\8ado.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1736 aaad.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 536 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 30 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2620 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 31 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 1948 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 32 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2236 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 33 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1940 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 34 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1944 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 35 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 1572 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 37 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 2784 wrote to memory of 2860 2784 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 40 PID 1736 wrote to memory of 3024 1736 aaad.exe 41 PID 1736 wrote to memory of 3024 1736 aaad.exe 41 PID 1736 wrote to memory of 3024 1736 aaad.exe 41 PID 1736 wrote to memory of 3024 1736 aaad.exe 41 PID 1736 wrote to memory of 3024 1736 aaad.exe 41 PID 1736 wrote to memory of 3024 1736 aaad.exe 41 PID 1736 wrote to memory of 3024 1736 aaad.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\70l8.dll"2⤵
- System Location Discovery: System Language Discovery
PID:536
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\03ca.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\da3r.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\8ado.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2236
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32\8ado.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1940
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\system32\aaad.exe -i2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\system32\aaad.exe -s2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1572
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32\830e.dll, Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\SysWOW64\aaad.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32\830e.dll,Always2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5ebd5936e818cd71abd71febce443ee74
SHA1b8bc8a6b1d7a09d4da389219f8dfed1a0ea66572
SHA25658aa2311c7ffbc780b596bb9013805a98eed982b3661a77672affa2a11dc99c5
SHA5127a7f1b7b169ef7034507c7b84479041f484cbcee5ee6de79e38738c77e36d4be006bbc3e1bb2c1a52d6b91ad1f15d5da1478fd781ed36dc4f29898f26f82baa8
-
Filesize
416KB
MD570bb23073ea04ec7dbcd3551c34a88b4
SHA1807a8e171467d233cd1a3e781835e12e173c977a
SHA256b3a3d49907af8f91e7b91bc405cb488b284f204695f171cc43ef5f580875c26b
SHA51255d4cdcfefd03ce682d261a9a1dc8de2b8db25ec3b29be0e0b7b839a9680d1f4e94b220e726870b82f5f1a34b770ebac8f52cfb4c5a536e761d54fbe1c3ee1dc
-
Filesize
112KB
MD56c10c7a65f4d0f0d99bae8ffafd7bc4a
SHA1be2ca7754c25883eafd6f360aca0ef4f7b6fda42
SHA2564c64de9142b676b890e4f0f13f1fed5c25736c3219a2922e2f779c2cb2fffd39
SHA5129a8af5d2a3257283c7d5498290eba4880a3f93799a2dcb36043fc65957d34054dbf3ec8b0b3eea305907ea31875a9f60ff59e74291881d1eb685a0d1149a8410