Malware Analysis Report

2025-08-06 01:37

Sample ID 241016-27vq2aycqd
Target 4f8b232e9457f18be375b581686fa3b1_JaffaCakes118
SHA256 1ad13998ccd9c464bcc99a520821b67c24fdb2268bfa9fe4c5cc85dc16ead024
Tags
upx adware bootkit discovery evasion persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1ad13998ccd9c464bcc99a520821b67c24fdb2268bfa9fe4c5cc85dc16ead024

Threat Level: Known bad

The file 4f8b232e9457f18be375b581686fa3b1_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

upx adware bootkit discovery evasion persistence stealer

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Blocklisted process makes network request

Executes dropped EXE

Deletes itself

Loads dropped DLL

Installs/modifies Browser Helper Object

Writes to the Master Boot Record (MBR)

Enumerates connected drives

UPX packed file

Drops file in System32 directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 23:13

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 23:13

Reported

2024-10-16 23:16

Platform

win7-20240903-en

Max time kernel

147s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\Dofake.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\Dofake.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Dofake.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Dofake.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6E28339B-7A2A-47B6-AEB2-46BA53782379} C:\Windows\SysWOW64\regsvr32.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ccy5750.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\dllcache\ccy5750.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ydile.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Dofake.exe C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\taoba_1.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\cpa_1.exe C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Dofake.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cpa_1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ = "C:\\Windows\\SysWow64\\ydile.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\ = "EyeOnIE Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\0\win32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\ = "EyeOnIE Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1\ = "ATlMy Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\FLAGS\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CLSID\ = "{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\taoba_1.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ProgID\ = "BhoPlugin.EyeOnIE.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\HELPDIR C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\FLAGS C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\FLAGS\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\VersionIndependentProgID\ = "TestAtl.ATlMy" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32\ = "C:\\Windows\\SysWow64\\taoba_1.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\ = "BhoPlugin 1.0 Type Library" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID\ = "TestAtl.ATlMy.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\HELPDIR\ = "C:\\Windows\\System32" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ydile.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ = "ATlMy Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\CLSID\ = "{6E28339B-7A2A-47B6-AEB2-46BA53782379}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CLSID\ = "{6E28339B-7A2A-47B6-AEB2-46BA53782379}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CurVer\ = "BhoPlugin.EyeOnIE.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ = "EyeOnIE Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\Dofake.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 1856 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 1856 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 1856 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 1856 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1856 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 1856 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 1856 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 1856 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 2816 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 2816 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 2816 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 2816 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 2632 wrote to memory of 1644 N/A C:\Windows\explorer.exe C:\Windows\system32\ctfmon.exe
PID 2632 wrote to memory of 1644 N/A C:\Windows\explorer.exe C:\Windows\system32\ctfmon.exe
PID 2632 wrote to memory of 1644 N/A C:\Windows\explorer.exe C:\Windows\system32\ctfmon.exe
PID 1856 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1856 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1856 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1856 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\System32\ydile.dll

C:\Windows\SysWOW64\rundll32.exe

rundll32 ccy5750.dll , InstallMyDll

C:\Windows\SysWOW64\Dofake.exe

C:\Windows\System32\Dofake.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\System32\taoba_1.dll

C:\Windows\SysWOW64\cpa_1.exe

C:\Windows\System32\cpa_1.exe

C:\Windows\SysWOW64\explorer.exe

explorer

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c 375519961O57540.bat

Network

Country Destination Domain Proto
US 8.8.8.8:53 union.download.wps.cn udp
US 8.8.8.8:53 www.superqqface.com udp
DE 91.195.240.12:80 www.superqqface.com tcp

Files

memory/1856-0-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Windows\SysWOW64\ydile.dll

MD5 f0508d5e39bfed1f9f5b5ae9a062ea6e
SHA1 32c16f35f62d4a2d30f7dce507bee850f029ef7a
SHA256 a85c7d3290a25a44be1f858521da0e777ae62a44ddc0a0f18113ef55549d8a19
SHA512 1cc766b0b289eda8651509d7843be239ef04612b74f8f22552c643543ebafde6b65919b37c3a0b5da8a496eeab5d1ffff12702a1b0d3da5d1a651c8700a4bd29

C:\Windows\SysWOW64\ccy5750.dll

MD5 eab4d3ae8c9f2ba262802b21b96d99fa
SHA1 e66f6b9b9f272238514dd8242d9ce9ba2c73ff04
SHA256 55ae6670a0f1f69354883e67c5ed9c216dcd7bf133108bda8cfa308e916cad4b
SHA512 5a50d643c5f10935a1c9561a4aba1b3b860f45b1a741f8ad58e6b6ed1f254cc82456e1f23dd4a6416ee81e5d681ac0f86022204ec11f4daa0686b9b2997978e8

memory/1856-10-0x0000000000400000-0x0000000000459000-memory.dmp

\Windows\SysWOW64\Dofake.exe

MD5 5aebe3daaaa5b3101c10faf213f362e2
SHA1 e14eca13088bdf2e717b3f77273da8c6bd58c7f1
SHA256 97c4d2f5b7d41bfe67b5c1f7177cbb04628a9a5d09d21c1d0f2e6865843d56c7
SHA512 38707a3d8ef5b3407accb3caf8ec807bc509d7cc9af6f73998b99cec2dc2489140924c9038258620cb80662ff0e604455380ad9c80625e3b66a7cad1b74d329f

C:\Windows\SysWOW64\taoba_1.dll

MD5 92d98e99b7f407edf3f22112b4820334
SHA1 1644c2f67918ffdd267cdd554a3ffe3e9ea542ea
SHA256 8b271999d7cf97556a64a22e4603a8def932515c2131ca05eb48809de481b703
SHA512 a71c07ef0082337fc99587354dc5a169ee2c8fd6d57edf430aae2cfa40f15f57e60f9c9b35b2e2f7550a19cd0271f50849ae4af1f40c54083d28a042b4468ba6

\Windows\SysWOW64\cpa_1.exe

MD5 481d889fdf7c229a0cbee2a4306bdec8
SHA1 3dd11c05e2c574083a88ec5ce02af3c24ef27dd4
SHA256 038ce6624bd5ba6a7f2d416b0f9b6aa4147efa896c757ebcbb450fde22bb0226
SHA512 1a778d97c3b5bda0e7a5d7097631e192a014daab11180646510b59d498a8aa2638d672785daeb410ff38715a399ac306abc5b303d18b93194218dd48174dcc10

memory/2632-33-0x0000000003E10000-0x0000000003E20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\375519961O57540.bat

MD5 682fd3a4162e12281a52a7a43df4d2f9
SHA1 d4e51b0efecbb7f0115bc4a8a4dfd45d277d165a
SHA256 d56a3c7d69756a627e20577f1cf888cddd8741c69947662c2817d2623f6caa75
SHA512 759c30ebce7e5c96eb5b0a829b58e1586880cb0db31c89836cbce8d73f475eeeb5ebf3e0bff2ea6ebc0b02fe58eae28b2d7f55059227e314754ccfa0e962bd53

memory/1856-44-0x0000000000400000-0x0000000000459000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 23:13

Reported

2024-10-16 23:16

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\Dofake.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\Dofake.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Dofake.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\Dofake.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Dofake.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E28339B-7A2A-47B6-AEB2-46BA53782379} C:\Windows\SysWOW64\regsvr32.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ccy6499.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\dllcache\ccy6499.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ydile.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Dofake.exe C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\taoba_1.dll C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\cpa_1.exe C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Dofake.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cpa_1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32\ = "C:\\Windows\\SysWow64\\taoba_1.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ = "IEyeOnIE" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\ = "testAtl 1.0 Type Library" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\CLSID\ = "{6E28339B-7A2A-47B6-AEB2-46BA53782379}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CLSID\ = "{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\VersionIndependentProgID\ = "BhoPlugin.EyeOnIE" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer\ = "TestAtl.ATlMy.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ = "C:\\Windows\\SysWow64\\ydile.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\ = "EyeOnIE Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ = "IEyeOnIE" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\ = "ATlMy Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ = "ATlMy Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ydile.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CLSID\ = "{6E28339B-7A2A-47B6-AEB2-46BA53782379}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\FLAGS C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\0\win32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ProgID\ = "BhoPlugin.EyeOnIE.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\ = "BhoPlugin 1.0 Type Library" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379} C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A
N/A N/A C:\Windows\SysWOW64\cpa_1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3888 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3888 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3888 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3888 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 3888 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 3888 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\rundll32.exe
PID 3888 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 3888 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 3888 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\Dofake.exe
PID 3888 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3888 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3888 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3888 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 3888 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 3888 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cpa_1.exe
PID 4988 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 4988 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 4988 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cpa_1.exe C:\Windows\SysWOW64\explorer.exe
PID 3888 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3888 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\System32\ydile.dll

C:\Windows\SysWOW64\rundll32.exe

rundll32 ccy6499.dll , InstallMyDll

C:\Windows\SysWOW64\Dofake.exe

C:\Windows\System32\Dofake.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s C:\Windows\System32\taoba_1.dll

C:\Windows\SysWOW64\cpa_1.exe

C:\Windows\System32\cpa_1.exe

C:\Windows\SysWOW64\explorer.exe

explorer

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c 375519961O57540.bat

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 union.download.wps.cn udp
US 8.8.8.8:53 www.superqqface.com udp
DE 91.195.240.12:80 www.superqqface.com tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 12.240.195.91.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3888-0-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Windows\SysWOW64\ydile.dll

MD5 f0508d5e39bfed1f9f5b5ae9a062ea6e
SHA1 32c16f35f62d4a2d30f7dce507bee850f029ef7a
SHA256 a85c7d3290a25a44be1f858521da0e777ae62a44ddc0a0f18113ef55549d8a19
SHA512 1cc766b0b289eda8651509d7843be239ef04612b74f8f22552c643543ebafde6b65919b37c3a0b5da8a496eeab5d1ffff12702a1b0d3da5d1a651c8700a4bd29

C:\Windows\SysWOW64\ccy6499.dll

MD5 eab4d3ae8c9f2ba262802b21b96d99fa
SHA1 e66f6b9b9f272238514dd8242d9ce9ba2c73ff04
SHA256 55ae6670a0f1f69354883e67c5ed9c216dcd7bf133108bda8cfa308e916cad4b
SHA512 5a50d643c5f10935a1c9561a4aba1b3b860f45b1a741f8ad58e6b6ed1f254cc82456e1f23dd4a6416ee81e5d681ac0f86022204ec11f4daa0686b9b2997978e8

memory/3888-7-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Windows\SysWOW64\Dofake.exe

MD5 5aebe3daaaa5b3101c10faf213f362e2
SHA1 e14eca13088bdf2e717b3f77273da8c6bd58c7f1
SHA256 97c4d2f5b7d41bfe67b5c1f7177cbb04628a9a5d09d21c1d0f2e6865843d56c7
SHA512 38707a3d8ef5b3407accb3caf8ec807bc509d7cc9af6f73998b99cec2dc2489140924c9038258620cb80662ff0e604455380ad9c80625e3b66a7cad1b74d329f

C:\Windows\SysWOW64\taoba_1.dll

MD5 92d98e99b7f407edf3f22112b4820334
SHA1 1644c2f67918ffdd267cdd554a3ffe3e9ea542ea
SHA256 8b271999d7cf97556a64a22e4603a8def932515c2131ca05eb48809de481b703
SHA512 a71c07ef0082337fc99587354dc5a169ee2c8fd6d57edf430aae2cfa40f15f57e60f9c9b35b2e2f7550a19cd0271f50849ae4af1f40c54083d28a042b4468ba6

C:\Windows\SysWOW64\cpa_1.exe

MD5 481d889fdf7c229a0cbee2a4306bdec8
SHA1 3dd11c05e2c574083a88ec5ce02af3c24ef27dd4
SHA256 038ce6624bd5ba6a7f2d416b0f9b6aa4147efa896c757ebcbb450fde22bb0226
SHA512 1a778d97c3b5bda0e7a5d7097631e192a014daab11180646510b59d498a8aa2638d672785daeb410ff38715a399ac306abc5b303d18b93194218dd48174dcc10

memory/3888-27-0x0000000000400000-0x0000000000459000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\375519961O57540.bat

MD5 682fd3a4162e12281a52a7a43df4d2f9
SHA1 d4e51b0efecbb7f0115bc4a8a4dfd45d277d165a
SHA256 d56a3c7d69756a627e20577f1cf888cddd8741c69947662c2817d2623f6caa75
SHA512 759c30ebce7e5c96eb5b0a829b58e1586880cb0db31c89836cbce8d73f475eeeb5ebf3e0bff2ea6ebc0b02fe58eae28b2d7f55059227e314754ccfa0e962bd53