Analysis Overview
SHA256
09dcac07347dfd28950539b6e5a97063ffd1a5b5798d341c560a8129813e931a
Threat Level: Shows suspicious behavior
The file 765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Executes dropped EXE
ACProtect 1.3x - 1.4x DLL software
Reads user/profile data of web browsers
Drops Chrome extension
Installs/modifies Browser Helper Object
Checks installed software on the system
UPX packed file
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Unsigned PE
NSIS installer
Suspicious use of WriteProcessMemory
Modifies registry class
System policy modification
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-27 22:53
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-27 22:53
Reported
2024-10-27 22:56
Platform
win7-20241010-en
Max time kernel
118s
Max time network
124s
Command Line
Signatures
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
Reads user/profile data of web browsers
Checks installed software on the system
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhdekhglbpcpidjnfhfonlehaodjpadg\1\manifest.json | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.dll" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ThreadingModel = "Apartment" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saffe saevue" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID\ = "saffe saevue.1" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.tlb" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} = "1" | C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe
.\51e8e611a83cb.exe /s
Network
Files
\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe
| MD5 | b78633fae8aaf5f7e99e9c736f44f9c5 |
| SHA1 | 26fc60e29c459891ac0909470ac6c61a1eca1544 |
| SHA256 | d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22 |
| SHA512 | 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\settings.ini
| MD5 | 140ff6ea77927ed5eac49cf96fa4c5b0 |
| SHA1 | 820e2e22390419845b359a9d52b6c7162bfc8fdb |
| SHA256 | d7d7db8ede6fba8c7456b5ef3ca2678d5802ecdc7e3d772c38187a4023e1b848 |
| SHA512 | 98331f40439d5ed6c75e425b3ff109805b0524eb4843f09a2479958be5649f70f2a0664326bb469a8073ef5cc68542f08bbcf41b6b7e7ce2b33d200d45ebc8ad |
\Users\Admin\AppData\Local\Temp\nsz5C16.tmp\UserInfo.dll
| MD5 | 7579ade7ae1747a31960a228ce02e666 |
| SHA1 | 8ec8571a296737e819dcf86353a43fcf8ec63351 |
| SHA256 | 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5 |
| SHA512 | a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\bootstrap.js
| MD5 | ab4383ac993b4fb6575c772f218e3f09 |
| SHA1 | 96290924add5f885c018d6746d05c65e9a56f1f4 |
| SHA256 | 7c9200c7c223d32a10c4240e1a88bf868776c1a739cd35621107daba8b2ae1ff |
| SHA512 | ca7e3e490d8d8fa5d4b640bb2a09e65155a0826b12c5363dab8bb587d6a9b9832821c7f3a9fc15b722f1ed07b79e331bc06fc0dd3fc1e43c7ced7c016353587c |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\chrome.manifest
| MD5 | daf5263cfd9bbaecb562b23ecc745fdb |
| SHA1 | 7c81cceaa807d2550a80e390c5869b1f25ccd248 |
| SHA256 | 4ee519aaa98db6dc6b7e3c11d418a4bda63f86345dedfcf05dc3cc9e4487da70 |
| SHA512 | 0bb6e0a63b214415f96b7aae2af8199877f9d55e5cbac3cde2f7575f8935e929be0cd144c6fd90a7b774aa11bbef79a5f39d54b4f310c1a6bcabdae682d6f71b |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\install.rdf
| MD5 | 6485a09518209dc955e9b81dcc7e7b3d |
| SHA1 | a15d64938220566a031eea2692d02612b5ad0360 |
| SHA256 | 53f6f2d2c7ebda06fedc9342beb69fc9c6798bc301406d3e7b2cc82ab2afb75b |
| SHA512 | 61b8564c52bc7c01a7a2567a97a72651408f15a4c63cad3464407e60df0a8db51c20dbee65892e5cda8b1ef28c63aa84f94f1d9ee7371512a5e8dacc38d80868 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\content\bg.js
| MD5 | 084aec693fa093b650bd650d2213028b |
| SHA1 | 16a160ef8371ba5698c315d0bd6e3dea9da3c47c |
| SHA256 | bb4e16e1b5fbac58ae4565ae9a81abcc1a598bd6a5d0ee5730d3ac817e69e61f |
| SHA512 | 2c53b3f8a4be5162c0f88674f2ea1b7ae22cff80bbd13354c47131d685595ce7ebd7d2cc378e6dc1beee2e4124105ef401f690e7d33f540246e8c043295d1c79 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\51e8e611a81e17.02675710.js
| MD5 | 39e5e68719f07e9a0c2c600b25ac4377 |
| SHA1 | 42f0571a3180f1d36a0829bb84decec5190c9421 |
| SHA256 | 4f93b69b45bf73e1e58debd2a787d1d38b92c1fa3beff632d41445fc342d27b3 |
| SHA512 | 866915a506851b19105f2f5db1b90411359201450b1a86fb68bd4730695d0db110b90c48c32784649fe06247a09dd845b0dceda9a9d38030ce08af83c2552c94 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\background.html
| MD5 | dc3ac91dddc699fb9092ee7d06d12287 |
| SHA1 | 4359590d8562c8315d000805b171b691033ad51e |
| SHA256 | 14711b58731ee8ed01a251bbd179ebb5ea65dcf84a0ba8b3ff2d747aa0ff28db |
| SHA512 | 851f7715d70f291ecb7b2a0cbfb94a35cd0f8e309e8b4aff97243afcff4ea1b89e898d336f5fe7510002569c3bf82c809a2be194cc22bbb519e422ad0b807ef6 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\content.js
| MD5 | 5f9891607f65f433b0690bae7088b2c1 |
| SHA1 | b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de |
| SHA256 | fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b |
| SHA512 | 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\lsdb.js
| MD5 | 209b7ae0b6d8c3f9687c979d03b08089 |
| SHA1 | 6449f8bff917115eef4e7488fae61942a869200f |
| SHA256 | e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704 |
| SHA512 | 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\manifest.json
| MD5 | e74a293de62fd297f21536a7f30b92eb |
| SHA1 | 7840f24e31050f8fbbd12bbaff11699ca45ae526 |
| SHA256 | 34246e56e28f5a391aa7f64bb74611667a7265146ee92b5a905cd380226326c0 |
| SHA512 | 5de49d74d74bf8c5c6d29a8b294a8e0b2c948f0b8683b00fbe7ce1b7f6cce22005c4c333680e6f975e830496a3cddc0e27585cc33f4085a8a62f9280de4d8221 |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\sqlite.js
| MD5 | c43c5a3c2f9ace3f85d58942f414a998 |
| SHA1 | ef2309d0dfd886f03053d656aea1cf398e2a595e |
| SHA256 | f1e9ce4a4acacb7dbea1bc93ab0a4ffe625f858511890b60c5e2996ad826bf99 |
| SHA512 | 2deb31cd5e7c73f1a9b5809b1c22ab9b39fef297853597682d63008b4723d137e99b3e0895f7d7a9e487b059de21d3789839ab9266eac8e73c7bab52550bc69c |
\Users\Admin\AppData\Local\Temp\nsz5C16.tmp\nsJSON.dll
| MD5 | b9cd1b0fd3af89892348e5cc3108dce7 |
| SHA1 | f7bc59bf631303facfc970c0da67a73568e1dca6 |
| SHA256 | 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384 |
| SHA512 | fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90 |
memory/2912-76-0x0000000075270000-0x000000007527A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a8404.dll
| MD5 | 05234975b085632d70d89c2f420c5107 |
| SHA1 | 078fb2a3e5de54c3737a4541242a4725c02c6b9c |
| SHA256 | a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a |
| SHA512 | f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e |
C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a8404.tlb
| MD5 | c1e296ff01d3cf37f91c7473bdd9de52 |
| SHA1 | 832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6 |
| SHA256 | a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492 |
| SHA512 | aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c |
C:\ProgramData\saffe saevue\uninstall.exe
| MD5 | f3c79bda3fdf7c5dd24d60400a57cadb |
| SHA1 | 1adb606aaeedb246a371c8877c737f0f8c798625 |
| SHA256 | a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b |
| SHA512 | c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-27 22:53
Reported
2024-10-27 22:56
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
Reads user/profile data of web browsers
Checks installed software on the system
Drops Chrome extension
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhdekhglbpcpidjnfhfonlehaodjpadg\1\manifest.json | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
Installs/modifies Browser Helper Object
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\NoExplorer = "1" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.tlb" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ThreadingModel = "Apartment" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID\ = "saffe saevue.1" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.dll" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saffe saevue" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32 | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2176 wrote to memory of 1884 | N/A | C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe |
| PID 2176 wrote to memory of 1884 | N/A | C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe |
| PID 2176 wrote to memory of 1884 | N/A | C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe |
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} = "1" | C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe
.\51e8e611a83cb.exe /s
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 15.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe
| MD5 | b78633fae8aaf5f7e99e9c736f44f9c5 |
| SHA1 | 26fc60e29c459891ac0909470ac6c61a1eca1544 |
| SHA256 | d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22 |
| SHA512 | 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43 |
C:\Users\Admin\AppData\Local\Temp\nsrAFAA.tmp\UserInfo.dll
| MD5 | 7579ade7ae1747a31960a228ce02e666 |
| SHA1 | 8ec8571a296737e819dcf86353a43fcf8ec63351 |
| SHA256 | 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5 |
| SHA512 | a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\settings.ini
| MD5 | 140ff6ea77927ed5eac49cf96fa4c5b0 |
| SHA1 | 820e2e22390419845b359a9d52b6c7162bfc8fdb |
| SHA256 | d7d7db8ede6fba8c7456b5ef3ca2678d5802ecdc7e3d772c38187a4023e1b848 |
| SHA512 | 98331f40439d5ed6c75e425b3ff109805b0524eb4843f09a2479958be5649f70f2a0664326bb469a8073ef5cc68542f08bbcf41b6b7e7ce2b33d200d45ebc8ad |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\bootstrap.js
| MD5 | ab4383ac993b4fb6575c772f218e3f09 |
| SHA1 | 96290924add5f885c018d6746d05c65e9a56f1f4 |
| SHA256 | 7c9200c7c223d32a10c4240e1a88bf868776c1a739cd35621107daba8b2ae1ff |
| SHA512 | ca7e3e490d8d8fa5d4b640bb2a09e65155a0826b12c5363dab8bb587d6a9b9832821c7f3a9fc15b722f1ed07b79e331bc06fc0dd3fc1e43c7ced7c016353587c |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\chrome.manifest
| MD5 | daf5263cfd9bbaecb562b23ecc745fdb |
| SHA1 | 7c81cceaa807d2550a80e390c5869b1f25ccd248 |
| SHA256 | 4ee519aaa98db6dc6b7e3c11d418a4bda63f86345dedfcf05dc3cc9e4487da70 |
| SHA512 | 0bb6e0a63b214415f96b7aae2af8199877f9d55e5cbac3cde2f7575f8935e929be0cd144c6fd90a7b774aa11bbef79a5f39d54b4f310c1a6bcabdae682d6f71b |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\install.rdf
| MD5 | 6485a09518209dc955e9b81dcc7e7b3d |
| SHA1 | a15d64938220566a031eea2692d02612b5ad0360 |
| SHA256 | 53f6f2d2c7ebda06fedc9342beb69fc9c6798bc301406d3e7b2cc82ab2afb75b |
| SHA512 | 61b8564c52bc7c01a7a2567a97a72651408f15a4c63cad3464407e60df0a8db51c20dbee65892e5cda8b1ef28c63aa84f94f1d9ee7371512a5e8dacc38d80868 |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\content\bg.js
| MD5 | 084aec693fa093b650bd650d2213028b |
| SHA1 | 16a160ef8371ba5698c315d0bd6e3dea9da3c47c |
| SHA256 | bb4e16e1b5fbac58ae4565ae9a81abcc1a598bd6a5d0ee5730d3ac817e69e61f |
| SHA512 | 2c53b3f8a4be5162c0f88674f2ea1b7ae22cff80bbd13354c47131d685595ce7ebd7d2cc378e6dc1beee2e4124105ef401f690e7d33f540246e8c043295d1c79 |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\51e8e611a81e17.02675710.js
| MD5 | 39e5e68719f07e9a0c2c600b25ac4377 |
| SHA1 | 42f0571a3180f1d36a0829bb84decec5190c9421 |
| SHA256 | 4f93b69b45bf73e1e58debd2a787d1d38b92c1fa3beff632d41445fc342d27b3 |
| SHA512 | 866915a506851b19105f2f5db1b90411359201450b1a86fb68bd4730695d0db110b90c48c32784649fe06247a09dd845b0dceda9a9d38030ce08af83c2552c94 |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\background.html
| MD5 | dc3ac91dddc699fb9092ee7d06d12287 |
| SHA1 | 4359590d8562c8315d000805b171b691033ad51e |
| SHA256 | 14711b58731ee8ed01a251bbd179ebb5ea65dcf84a0ba8b3ff2d747aa0ff28db |
| SHA512 | 851f7715d70f291ecb7b2a0cbfb94a35cd0f8e309e8b4aff97243afcff4ea1b89e898d336f5fe7510002569c3bf82c809a2be194cc22bbb519e422ad0b807ef6 |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\content.js
| MD5 | 5f9891607f65f433b0690bae7088b2c1 |
| SHA1 | b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de |
| SHA256 | fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b |
| SHA512 | 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\lsdb.js
| MD5 | 209b7ae0b6d8c3f9687c979d03b08089 |
| SHA1 | 6449f8bff917115eef4e7488fae61942a869200f |
| SHA256 | e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704 |
| SHA512 | 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25 |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\manifest.json
| MD5 | e74a293de62fd297f21536a7f30b92eb |
| SHA1 | 7840f24e31050f8fbbd12bbaff11699ca45ae526 |
| SHA256 | 34246e56e28f5a391aa7f64bb74611667a7265146ee92b5a905cd380226326c0 |
| SHA512 | 5de49d74d74bf8c5c6d29a8b294a8e0b2c948f0b8683b00fbe7ce1b7f6cce22005c4c333680e6f975e830496a3cddc0e27585cc33f4085a8a62f9280de4d8221 |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\sqlite.js
| MD5 | c43c5a3c2f9ace3f85d58942f414a998 |
| SHA1 | ef2309d0dfd886f03053d656aea1cf398e2a595e |
| SHA256 | f1e9ce4a4acacb7dbea1bc93ab0a4ffe625f858511890b60c5e2996ad826bf99 |
| SHA512 | 2deb31cd5e7c73f1a9b5809b1c22ab9b39fef297853597682d63008b4723d137e99b3e0895f7d7a9e487b059de21d3789839ab9266eac8e73c7bab52550bc69c |
C:\Users\Admin\AppData\Local\Temp\nsrAFAA.tmp\nsJSON.dll
| MD5 | b9cd1b0fd3af89892348e5cc3108dce7 |
| SHA1 | f7bc59bf631303facfc970c0da67a73568e1dca6 |
| SHA256 | 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384 |
| SHA512 | fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90 |
memory/1884-73-0x0000000074050000-0x000000007405A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a8404.dll
| MD5 | 05234975b085632d70d89c2f420c5107 |
| SHA1 | 078fb2a3e5de54c3737a4541242a4725c02c6b9c |
| SHA256 | a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a |
| SHA512 | f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e |
C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a8404.tlb
| MD5 | c1e296ff01d3cf37f91c7473bdd9de52 |
| SHA1 | 832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6 |
| SHA256 | a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492 |
| SHA512 | aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c |
C:\ProgramData\saffe saevue\uninstall.exe
| MD5 | f3c79bda3fdf7c5dd24d60400a57cadb |
| SHA1 | 1adb606aaeedb246a371c8877c737f0f8c798625 |
| SHA256 | a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b |
| SHA512 | c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935 |