f38484003e400719dfbeaab61d2404796a98aaa4c9f9c975e7dca49b612130d6

Analysis

max time kernel
148s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/11/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
Size

580KB
MD5

b19570295774aa59a8ffb4849aa18735
SHA1

5aba19cbfe74b7b1992d1f85da0dd550753b5e3a
SHA256

f38484003e400719dfbeaab61d2404796a98aaa4c9f9c975e7dca49b612130d6
SHA512

dae4895ec6afa4d3665fbf1b8f84c3083580a346b7ec7b00e730fb21ae264a058e8a4074f843663264ff50ae336ed296b0259d178f79766652d31a2a59dd0fff
SSDEEP

12288:XQ5Tw3W1SXMe7tYm7CoaUAp/0vI4jkAEzs4k65j+oy5asIjkOSIb7xLXfCJ4:X0w3MSt7tKIe2I4fcsVO+oI3Ijkj47xj

Score

8^/10

adware bootkit discovery persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	aaad.exe

Executes dropped EXE 3 IoCs

pid	Process
2388	aaad.exe
2792	aaad.exe
3012	aaad.exe

Loads dropped DLL 49 IoCs

pid	Process
2708	regsvr32.exe
2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
2388	aaad.exe
2388	aaad.exe
2388	aaad.exe
2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
2792	aaad.exe
2792	aaad.exe
2792	aaad.exe
3012	aaad.exe
744	rundll32.exe
2024	rundll32.exe
744	rundll32.exe
744	rundll32.exe
2024	rundll32.exe
744	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe
3012	aaad.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "Microsoft User"	regsvr32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	aaad.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\03ca.dlltmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\8ado.dlltmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\70l8.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\0dr0.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\da3r.dlltmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\830e.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\8ado.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\055	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\30e6.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\33u6.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\0aa3.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\da3r.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\03as.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\0ddd.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\aaad.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\-100-73122-88	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\70l8.dlltmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\03ca.dll	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\64au.bmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\864d.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\64a.bmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\686.flv	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\686d.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\864.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\4acu.bmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\d06d.flv	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\686d.flv	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File created	C:\Windows\Tasks\ms.job	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\aa0d.bmp	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\0d06.exe	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
File opened for modification	C:\Windows\733a.flv	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 47 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\ = "CFunPlayer Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID\ = "BHO.FunPlayer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\ = "BHO 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer\ = "BHO.FunPlayer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "CFunPlayer Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\ = "CFunPlayer Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID\ = "BHO.FunPlayer.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ = "C:\\Windows\\SysWow64\\8ado.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\8ado.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	aaad.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1156	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2664	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2696	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	34
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2708	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	35
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2388	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	36
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 2792	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	38
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 2344 wrote to memory of 744	2344	b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe	41
PID 3012 wrote to memory of 2024	3012	aaad.exe	42
PID 3012 wrote to memory of 2024	3012	aaad.exe	42
PID 3012 wrote to memory of 2024	3012	aaad.exe	42
PID 3012 wrote to memory of 2024	3012	aaad.exe	42
PID 3012 wrote to memory of 2024	3012	aaad.exe	42
PID 3012 wrote to memory of 2024	3012	aaad.exe	42
PID 3012 wrote to memory of 2024	3012	aaad.exe	42

C:\Users\Admin\AppData\Local\Temp\b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b19570295774aa59a8ffb4849aa18735_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\70l8.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\03ca.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\da3r.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\8ado.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Windows\system32\8ado.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2708
- C:\Windows\SysWOW64\aaad.exe
  C:\Windows\system32\aaad.exe -i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2388
- C:\Windows\SysWOW64\aaad.exe
  C:\Windows\system32\aaad.exe -s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32 C:\Windows\system32\830e.dll, Always
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:744

C:\Windows\SysWOW64\aaad.exe
C:\Windows\SysWOW64\aaad.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32 C:\Windows\system32\830e.dll,Always
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\h8nil4o8\b.dll

Filesize
288KB

MD5
c550919968c7bae28eefff8faee8c878

SHA1
bdec60d1a2dca8774fe6be07e027a11100ccd73b

SHA256
7c76b3818a2c6d9bb910aedb7813637cba2bd069067dfa889b863ccb0e706872

SHA512
26e734550a04d77d7f7f014454711abc7acf6c539c3ca530cd78b1257af05cb99bf7b9e3dfda82f4d033a9c3f6167da09b626d5bdc1d9145005e32298f23cdeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\p.dll

Filesize
440KB

MD5
8e627e496abede85b71a8b3804c1e59c

SHA1
5f2ae22fd77c69e3a6dbf3f7896e572d864fd959

SHA256
886c0a2a5f73601ba082830bf2cabd8478637e528d90c4792df2037126d0e7a4

SHA512
3a1a91fe8a19a287e7ca720bacb2a1922d1d915907f81a205dcdd811a16b198ae83494511e2024cd51ab5db89a15264115b02709053b99e1e520c45c861e6726

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\s.exe

Filesize
180KB

MD5
9941f07fe21e3a1cef790cb459197ea0

SHA1
0acf779543a8814d01d8a966727019877d86f09b

SHA256
9bf78f73f9f09efa51065aa04ea34f4c330fb82212fc07ca338aae3570062a48

SHA512
dd07f0d996aaffbd505eb8645047185c4baf6ed9debbf23b3d200bef6d122e70b24787fe4e7a40efd897dc8c882b179f1416fd78cf1e51e358a82eed0dc2a3a5

Download Submit