Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe
-
Size
516KB
-
MD5
4fdf9ea8cab06346f3cec7a9382b4f6b
-
SHA1
68007586816601df7456a7b82055cdd52af4c137
-
SHA256
c9c2231837ae6c39dcb2b6bd1942e30de07fb082e4e89bac98805d0cacb88673
-
SHA512
08ae02af14c96f2f9e59106551398c723ad0925123a43ac0f366e033517fedb06a4ba5c83ec1f55aac3002b3eca557ed75de0a5f1b634285ac99387653b77f41
-
SSDEEP
12288:SbBKu3TIqcNuNQWjNNflg1Bn1QNN+xMBLc5/B5g2tcL4GM:S4u303PWJETnU+xMBLyxtcy
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 33ad.exe -
Executes dropped EXE 4 IoCs
pid Process 2744 msn.exe 1724 33ad.exe 900 33ad.exe 2060 33ad.exe -
Loads dropped DLL 54 IoCs
pid Process 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 2744 msn.exe 2744 msn.exe 2744 msn.exe 2916 regsvr32.exe 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 1724 33ad.exe 1724 33ad.exe 1724 33ad.exe 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 900 33ad.exe 900 33ad.exe 900 33ad.exe 2060 33ad.exe 1636 rundll32.exe 1636 rundll32.exe 1636 rundll32.exe 1636 rundll32.exe 2316 rundll32.exe 2316 rundll32.exe 2316 rundll32.exe 2316 rundll32.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe 2060 33ad.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B1108084-AA13-4723-ABAF-09D533AA6AAE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\ regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe File opened for modification \??\PhysicalDrive0 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 33ad.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File created C:\Windows\SysWOW64\ˆó%-8-3957-24 rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\0dr0.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0aa3.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dlltmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0ddd.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\33ad.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dlltmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aado.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aado.dlltmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\330e.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File created C:\Windows\SysWOW64\0b6 rundll32.exe File opened for modification C:\Windows\SysWOW64\70l8.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\70l8.dlltmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03as.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\30e6.dll 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\33u6.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s.exe msn.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\864.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\686.flv 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\aa0d.bmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\0d06.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\733a.flv 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\64a.bmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\686d.flv 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File created C:\Windows\Tasks\ms.job 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\4acu.bmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\686d.exe 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\d06d.flv 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe File opened for modification C:\Windows\686u.bmp 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 47 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\aado.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer\CurVer\ = "BHO.TwtPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\VersionIndependentProgID\ = "BHO.TwtPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer\CLSID\ = "{B1108084-AA13-4723-ABAF-09D533AA6AAE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\ProgID\ = "BHO.TwtPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\InprocServer32\ = "C:\\Windows\\SysWow64\\aado.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\AppID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\ = "ITwtPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\TypeLib\ = "{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer.1\CLSID\ = "{B1108084-AA13-4723-ABAF-09D533AA6AAE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer.1\ = "CTwtPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\ = "CTwtPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\ = "ITwtPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1108084-AA13-4723-ABAF-09D533AA6AAE}\TypeLib\ = "{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\TypeLib\ = "{D94D57B6-EA37-46A9-BBC4-8A2872E1D5CE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C350FF9E-710B-4895-981C-9151A0C9244E}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.TwtPlayer\ = "CTwtPlayer Object" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2060 33ad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2744 msn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2696 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 31 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2848 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 32 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2704 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 33 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2740 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 34 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2744 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 35 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 2916 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 36 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 1724 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 37 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 900 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 39 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2148 wrote to memory of 2316 2148 4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe 42 PID 2060 wrote to memory of 1636 2060 33ad.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4fdf9ea8cab06346f3cec7a9382b4f6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/70l8.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/03ca.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/da3r.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/aado.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\msn.exeC:\Users\Admin\AppData\Local\Temp\h8nil4o8\msn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/aado.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2916
-
-
C:\Windows\SysWOW64\33ad.exeC:\Windows\system32/33ad.exe -i2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1724
-
-
C:\Windows\SysWOW64\33ad.exeC:\Windows\system32/33ad.exe -s2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:900
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/330e.dll, Always2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Windows\SysWOW64\33ad.exeC:\Windows\SysWOW64\33ad.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/330e.dll,Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD52cfd87c3eef65aaae8a566418e68b2ba
SHA109934582b4eca060d9b2b472c36cc4969e9e8f4c
SHA25677743fd918213465eae1be00d8119f151f8dab69e05ee2c516302f129986279a
SHA5128104dec2839a58a069c6ddc128673526d21e3c123c4d8067e8d7174478cd9832428e6e6dedeebcc9fd42f8774f75357998d923157f10e225cee6b900363c517d
-
Filesize
424KB
MD54f6ce63267d08ab538075ea356d9eccb
SHA1018938262eb330fafa52614374c007b6bd60208c
SHA25690f87bc8a26d85bac8738ca0b41985b6d6e238c85f830ae713ccc6ca8a0371b8
SHA512e216663f9e36b8d5715ddd9a4a6e1184425759bca43414f1a34831a4c78f807d6e028d3c480e87fb4c4509900dce679554335d2c436aa351b56d905f71ef549b
-
Filesize
204KB
MD56046b7447ef80c1bd324ce1e5d01a22a
SHA1e3ae80092138630737c12fe57991ffa117071479
SHA256bacab1a9ba815a5533217ff432d3c2edf21f3f8ecdd8cf36f183e04c9e593a63
SHA5124bc29c866c9856a573d497cc53cc6199dcf5aa4e6e32f785e77a0fb5dd25efc0d7e643a8823186286be949f3e2cb76ae421d0e6f17908d2c6307e1e01ab708f0
-
Filesize
112KB
MD586b5a7321575d9566c2a0d6fd5c06ebf
SHA1417728dd2c778cff2b28d496a1897b5faa204b59
SHA25684a0670d1c653b85728074e13fb361a839870a596a3e2280f83026ade1dda468
SHA5120e92673b08268bb33310484e3de552952392875ff04767b0f7aad844b5ab2a0c1bc78e623f05a179ce1557f4a2649b34c720b8259fe714a7e0927bc0dbea0f5a
-
Filesize
144KB
MD5bd1b591d151e429bcb674e593a5d568f
SHA19cd91cee15fcad50f2853743b581ebec1e535b3c
SHA256856920c0868ceec051246d7c97c4a96f5836f3ab2abdbece35222c6eaf518c26
SHA512e044bad8420b30bbd761dffef716a2d8fd34f3ff9a20b3a6c2d8a773aa752377e5edde1b02b1ab9ded72198b22bc3f8997e1a0fa25cb4288dd9b3efeaa2c7494