Overview
overview
7Static
static
7JaffaCakes...09.exe
windows7-x64
7JaffaCakes...09.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
5$PLUGINSDI...oc.dll
windows10-2004-x64
5$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/Toolbar.exe
windows7-x64
7$TEMP/Toolbar.exe
windows10-2004-x64
7$TEMP/sqlite3.exe
windows7-x64
1$TEMP/sqlite3.exe
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 19:34
Behavioral task
behavioral1
Sample
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$TEMP/Toolbar.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$TEMP/Toolbar.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$TEMP/sqlite3.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$TEMP/sqlite3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
-
Size
748KB
-
MD5
d105c88fe2e14f3e28a115b6cbadee09
-
SHA1
aa0475837db0a5e1fd6ec20f89c2f40e0c664a0b
-
SHA256
17612a5d50b77aaf43c282c8fbc67254f93f20a9b1290f16449a088541964116
-
SHA512
0427b96c57f69dd40c3c87f63ff56cb02b9a6a65c303cd3e6f81abbbf6b2f45b2acbe2248a6e77b08bffc6f2ed55ab2c3f2b1ce8cf8dc270cd5309d14dcb595d
-
SSDEEP
12288:y6gcS2d2g7W1B2dNwnWTzBlqd+qUkQxv6ZUAybDK2VPW1jkxB4fc8vy4h26:y6317Mg+yod+ECvIgJ2gd860
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 316 Toolbar.exe 892 GLB56D7.tmp -
Loads dropped DLL 16 IoCs
pid Process 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 316 Toolbar.exe 316 Toolbar.exe 316 Toolbar.exe 316 Toolbar.exe 892 GLB56D7.tmp 892 GLB56D7.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Toolbar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLB56D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50} JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\SOFTWARE\Microsoft\Internet Explorer\Main JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000feb3354da8cf554589cef8d0f47951c4000000000200000000001066000000010000200000008083bb01d77ddd1857dcdf54e2e25652ae2a8518e17d8a7c588d9af978321c68000000000e80000000020000200000001b31e22784e8c539c18a1ad3313a3ad17e69e8fb0ef16f5846f61c47662028a990000000918bce9b5bb24db740a67e297206bce81be1cd890c155731a63c922654d4d23198d24eb03428612c8e1cbc1be1d20585903f34fae25b496b8f931cdfb7b1d54ca9bad0551c0188a3e5906b7ee9978b1716325442f4e3954348edf0273c8e67ebdd7c0c3bc34ad28ed79e68702227005a2a67e61802f98ca4c29c544e1fc5052817f430c34cb79f83909d57836362b56b40000000c6abee2239e023eb42905d7cd369f1806c3521573f5d3d51467ecacfb9fc804820bbe924bf514e4024d32b17481ff089eb78ce6cba0080dca60fe5b16199da09 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000feb3354da8cf554589cef8d0f47951c4000000000200000000001066000000010000200000000d71879e83f451940f305e34ba926387d68dde98a082f4062f8ae693178ef2fc000000000e8000000002000020000000f3cb4fa1f176f5f442096ea012a40dbdc16fb0cbf585a57feb2643f1f8452dba20000000c0c955a7b405350e15ece2f061c1646404652f8ac0ddf7387db1c197d44542c8400000009e059bd5a903f6a740a9292f1e0c0caf9fa6e39e26cafdeda08196817bfaadc0337bbe18041aa44d165f4efb6ab410ce0fdd37ebb7a4de69a1c90f0d8742a4ce iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443477144" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70119642a96adb01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A939DA1-D69C-11EF-8E45-E699F793024F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000feb3354da8cf554589cef8d0f47951c40000000002000000000010660000000100002000000064c3d69ca9496262e560b1c681f797272fcb83b493de81d0acfc3befad081e1d000000000e8000000002000020000000c4e2e3ecfa46431dcb30e8caca4919347be21189e3d8e655e4c75385ece5655450000000f852274206b80c15bbadacdf4dae15836c31cc267f77e6605bdd49f3a6bce76f94d71e98d09e439fe1dce1d2235e98d70e8fafeb52ed709f218285794713377add8d0c2cca28a7513032eb2e6851445d400000003ed0b92688bf47b7453ab8c414e59f3950d9f3413212ba88fba932956e40a08d279da0fe540ce84a265aa4a90860ecebf4abfb458028e9eb4fd661aefce1849a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50} JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 892 GLB56D7.tmp 1732 iexplore.exe 892 GLB56D7.tmp 892 GLB56D7.tmp 892 GLB56D7.tmp -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 892 GLB56D7.tmp 892 GLB56D7.tmp 892 GLB56D7.tmp 892 GLB56D7.tmp -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1732 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 31 PID 2796 wrote to memory of 1732 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 31 PID 2796 wrote to memory of 1732 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 31 PID 2796 wrote to memory of 1732 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 31 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 2796 wrote to memory of 316 2796 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 32 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 316 wrote to memory of 892 316 Toolbar.exe 33 PID 1732 wrote to memory of 3040 1732 iexplore.exe 34 PID 1732 wrote to memory of 3040 1732 iexplore.exe 34 PID 1732 wrote to memory of 3040 1732 iexplore.exe 34 PID 1732 wrote to memory of 3040 1732 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://pf.toggle.com/s/3/6/36532-91420-gom-player.exe2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Toolbar.exe"C:\Users\Admin\AppData\Local\Temp\Toolbar.exe" /s -silent -DefaultSearch=FALSE -StartPage=FALSE2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmpC:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp /s -silent -DefaultSearch=FALSE -StartPage=FALSE 4736 C:\Users\Admin\AppData\Local\Temp\Toolbar.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faee7b730705c546f3c88306a6fa2699
SHA1f836efe1a81a91aaadd744a127398495e3f0928c
SHA256afdc83e4f3a2112be0f03816c4aeaf372e250721e8b0743d869f205dd92a5b75
SHA5126bd97b71319d254227656066ae932154ed0a00f6430c92e0a507cdbee9b128c0263f7b50ec0eda8f2f618ba0a743109b890e7437d6736daef496f0dcc55a17db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f67aa9d7f54ebdfa184b64bf2c6e9e1
SHA12bfaf914c0305bc671e52ef0be3f0391244931da
SHA256865d8e7181293d816a213e86fb61d66725bb869bdda907ac6396c1cd49566f6a
SHA5126c6bfe4a4533ab3f0a2c85769f37c81597ad382852e8fff72ffde2c47e90ecb203597b7ce4e658280454777a57945582683137ea937d34e182ee532109837c69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efde17fefe77ec1489ba9e0cd179523f
SHA16d851ec8af5f7d84f43ea4fa57ffeeb4545698bd
SHA256e91ceccb7c3474a34d6a56e9ec1d147212e111583a8fb991cdae59ed838a498c
SHA512c890078a5babbfc1c3ce1facca2c4e27be896159bfc813b7c43cb0335a49c2704f5cd5682b2d6f2848edca257313e34f145eb0d8495141f280b93486375a287b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54291bc1b0728bed306d1492474ff39f7
SHA11ba20a86062e4a025f8538777ca809125c04b762
SHA2562e044aa3397a1f0c320bf9afbd1c87e262570ea60b03fccff5d560dc523e1df2
SHA5125eb3d28e07f0aaeecd7955b74f9c51f2b79914de971fc258901e5a2317f93f2bd74c708920edd74684c77fea3b58f6bcbebe0809025d8fac81e168f0bf58f861
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed4c3a8d039e7202e1943269ee795729
SHA1860545be825dae004e4f03f94d8c45f57a4bd4d8
SHA2565636dbebb86f3767a345bf8dc85609d483b97486a9920c3993a653ec5fe38de3
SHA512bb25893231d6deb9bb362e9b149ebd9b57c8d1590010e2d8c82958c2b623cec619023f74513e040ef20749ada3f46fa3bc9c0e8ca73976a6f0be4039ebeb6a2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3898b2d22a8d466a255922a50729d7a
SHA1e9be631938512b8798fd8e9d4ed84515271ca5c5
SHA25687b2015a227b7d4735ca2dfdd62f0593c09051f268614c7bd90c2b7ca6983844
SHA5128bc7836dc6e74f72b760b501bf38e5fc79ede3b5cca8ba9786cf2c07a96e0216d2dbe0d60b5d41806720b9435401895070b8843501cd2329e31270a5db399b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51486d35100e9f36e269036e120f08766
SHA198853f67c171c78f69e5b7cce6b34ca310faa128
SHA256b4349c6f574e2dcec867df25bc772eaaeababc1b059d3b193e6345c1211e3112
SHA512c5511c7b93a0a53ed191fd47a1767b5087ab02f9922a41ca37acdf8717f739b0daaf763da66fad98ded405884de483b9861727577ef8635cf603e18adf15916e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e7fb35bbf013b60f83ee5afe0a98f68
SHA1ecece28cbc0b48d8fe6c9b3864aee0550bcce7f9
SHA256300b046891c11a1f05e29c7cc2101636600b149023d472ddb577118233a8e0fd
SHA512991f689d8084a0f3ffd2c034ac7f5da0924b113df1956d894bf47935e09761eef55186b3a52b98861c88a4f3e1ea2dff1cdc64d3f5292fd3bed890b69145a395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec98d5a90b16bcc7b648cd84ee47177f
SHA1635fa5861306dd15180354755be38ea6e6d3a778
SHA256bf852a98cabae1bdeed3ad22f769c238df1cab41abb8bc8357640f9f82eb7fb0
SHA5126e0f01ca0e66edf24de0e02566d5ffc83f16b1c34d6dc064075bae698d49672a1dcba0d067b4e4d7a2ec35dc60b4f26ed5632260e5b75bf79013e65f36b67c11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee3167b2d5b18bdf367e87f99c2442c1
SHA1684316e072b7fd8c38d2a772f98f7c2bceb6b26a
SHA25611b2816eff9fc0496f91a9dcf0ecc29b98a712c2730d249ca27fda85c6f7872e
SHA512ae14279c214141d7d22374584d3a2625ad4e9e89369e5595d3a49f0c80b814e9c695510280adab3e2137520e9dbf62def4f7320b2aa59819d85cad177dea2d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a35ed86567f6779728f494d18b7f0d0f
SHA171e200884a10bf6254ce522deea5eed7e11fc804
SHA2560934509db031d78c9ffb527e87c5437ff496746e7cd2ca4be0cdace54b29185a
SHA51263b901432bae5f8c1e64cbae933dd6ecce50679d4ca7727d11cee6231eb838d0e8b12be5be5df3fff97ae6509d61468a9792fa7c059bb67bea43aa49e91cf819
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538c1f08b71dfc029668809e981e7a761
SHA19684aee0ee4dc26c1d59955a9ed408e456c6d1ca
SHA256e424959489272ef7c7b51865f25dd33fe2d6c5bc04099581c0ba946d2f30c76e
SHA512921d8a75b1e36c1f8db2b54a0c86c3e49f44ab4ad0d30395b4cf4b50c918725623d506787df2371adabaae1e8c85b91b2b48f05cd92b63895ad353a9e2ddab1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf82392a2aba9675333bb099610dc3b
SHA1ac93e9a80033aac58543de3ae4671a7beb965911
SHA256a9af61a13fb1cff8046026cc5d1568252eb3d7bf184c01119db33a22bab35a6a
SHA51229e513bcc4ba72f025185251c7601df14622419ff15129d7b12034c57b593666562777d91e69939f24871d0dee7f29d6ece6b26e32630c767b3ec62e5cdbf527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a75214bfcc5368e6a3c1b4d5934fa245
SHA1bec31e66be4e1737238f7462b3ea27a49f2953cc
SHA256b87df5a895d4f9cee36e2cc49709c1694423c7654ccacfd9801811c384b090e7
SHA512b37d22c6a967eb27874f84805ee4c13e3966c6631f378cd6a3d12ce79c7288d3e0c07d57f607916e284741d79c7d7ba77224f82796eb711b9fbe12923f00d7e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577354c3c967eb3390350968344848fef
SHA18dad03be18611e7ac6dc057c518ade4792633382
SHA256958444eefcd00e9803408f256d939e6d4ac093b5572e3e9978b674b2e0e6b79d
SHA512a9c4df86bc7c8486da23b7e38b3937f2c99bd22844c211be97912c98726625f940742674dc6e08fddd8ed8ca6386d4a304b2efa354c5b2116ad2a7dd9cdea285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe99aa61e29093150738315285193d08
SHA1cf86f34bc91d6e879079a0c442c5e628220ff189
SHA256415c46ae397b8014f580d0e1cf4e3190b0398ee7141e8835f2d5b772b8e93112
SHA512fbaa1c1d3db4a545bc33218cff1738dd0c53f3c05f02c3639a578371e7f4b9c0262607c48c80bd7259773109d2a478aad213043cd86d00e0fc04d8d1f3af189f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5250685180d33a671acea6a1c5cfd407b
SHA149b0055f5967bc5a98fbd3ed0fc3f08e75058209
SHA25675986a4d10979fa40211c6cc19748757322c196c232f0d67ac79f2a7b9ce8cf6
SHA512756fcdc179548ecf6e7a84da0517e676c4a26459bf90f754e5e948810e6119b16b7cbe83e22527a63a91c89593dd34dabfaaea338d49e60f2cef0168ff677081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5089bf0018d4f3d47399390f023c935ed
SHA189f6133a2da3bd07a440e09098713558fabe6acc
SHA25612313b1ebafc65f75557ca9b208264839dbe48f3613f0db5d7e7cf1ab824e2f9
SHA512dc08a24115d3b42b65baa853a81e0721710d11c685b9993f05abca2ae515da18e4291bfa3ac1caa94d2d5f6c81759f706a544ed2b6165fa7799e23262c7ce4e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fa567cc7a77b850bdddd08352772996
SHA1dd00a802f0e1e5d80ffc022a6d66f976a1d98fa2
SHA2569c26db3a1d0fb355837513d1669ac76d282a0def68a7fe28f3aaf90ca3bb3e00
SHA512c49f5bfcb2dc4019f16f945b27ba7fcf5739b8800c3635af553e3cee980a078ae1b4bdeec9350f0eb202e008108c62e7f18925f0fcac419ec87ab42cd2318f85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c60ddefe9e4682005769d014ed498c3
SHA12afcb61cda04d07ed8c1e9f92207239ae71ad92b
SHA256e6a98f45da401bb771a02d6501986d13f8451dc68172d9e611e88be3edcb0f19
SHA512708fdc0cd74e3f969b57c93e997ceb5be54dd9f986fb08c77edffb1967dc2be22f0003f6d97aec08272fafd5bdb7535dbc5f25888fd4c4ef43da611af9d9fdab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd65b6ab1792e9420ac7422e73ace3eb
SHA17b41d20f24174de6f04233dbd74ed9af748126e6
SHA256c63abc866c9016141dae65bdd5e5b9b15405eb33eeea8de33ee447f595ae6ad1
SHA512da3f2bc95f763fd54da4e90700277edf7c7a92ba4afe3b4df71c6f303cae090687672c143f10083819a9ba67aaca778d9c63dfffc93f2ba30043f193f5a46c7b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD57d6130f0f1dff8d00c5669054ec3df8e
SHA1a1ad9e4b87ca4c86a32b013c5e646afb399a3b79
SHA256d4473eb6963c22c925c86a3e2c73c9516165ae4572254e623260edc3431d2171
SHA512e9343da67f78a0473883701c8b71da79e57dd8647d7f18a18587ab84309135793422ce161c5b8026e1f774a9ceb825813d65c563858b36cb93107919cdefa935
-
Filesize
1KB
MD58c351a5933cf4069784300881de65248
SHA1bc4037b9d512bb85f09ac6872e3d69eb80e6c9e8
SHA2568b1c160d076002c64e5af390b80852680da6d4f70b250c817705c103b2c367f5
SHA512abd3fef4a8c992fe3613d4a284c86c1ec0d2a4c9c6ed195e6eef4d7c9a1c1050a03ab9320e4defdf2ada6e4e5f1fc1d29ccab3dc55ba30e30e2d909ddac89767
-
Filesize
1KB
MD56095bbbfee29184e2ccb5ad51cd3778c
SHA1fdc517201b53a90fe712b99cccbf98d10527f383
SHA2567071497ba3ce2e01c7cfdd0adba1e989dcec826525e133dbb7e1cd0b652c925c
SHA512cd38835c41c1e05aef11d719c7d4d135fcf2728ff58fa815e225656e3b07c24628251b52e9c143878c1146d9209c1d247d30e2fe1735571ae09e9b6ffc88c5c4
-
Filesize
1KB
MD56a0f8611b571c4c150b862e4763c1196
SHA1fdd8813618853ae27c4db919fd174ae8a928e890
SHA2566e60513b67773030dc4e3855a0d554b5865cc28610a95685818d82e60d65abf7
SHA5126ca666a7ecf6c4f3cb5c79a80317f74b1ca4254bc3a32a845160ba4a48e7c06ed7d461a31aaa62b099a5d5eeea9ab44a6770c51bf0383fcb0d94a72df85adbe9
-
Filesize
70KB
MD5793a2c91c1b687b58809d7bb079457a7
SHA129363e8d0591accb9dc84512c6e634e1e17c591e
SHA256fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b
-
Filesize
161KB
MD58c97d8bb1470c6498e47b12c5a03ce39
SHA115d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA5127ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
-
Filesize
12KB
MD5484cb68472473a1a84ff07996bb8c1f6
SHA1bce9d810f2558e73854e7c8e05f122b002558e9a
SHA25615bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA5125f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47
-
Filesize
198KB
MD55a82a45f2e0aaf617c8d511d43100fe1
SHA1515aa5b88b8c129046706d8542bee3699f62968c
SHA2564761b338dc54c9a3adec6a79024029d5041b75f4f9bb30baf98b5d3ff34d7614
SHA5124811406accf89eac961a349b78449185e894ae4c89a7c380da1e67005c953ef782e57d2370fdc09027bb36586ad57d2476888b33b5913ca74142c72b1c17051a
-
Filesize
31KB
MD583cd62eab980e3d64c131799608c8371
SHA15b57a6842a154997e31fab573c5754b358f5dd1c
SHA256a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
SHA51291cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
17KB
MD509caf01bc8d88eeb733abc161acff659
SHA1b8c2126d641f88628c632dd2259686da3776a6da
SHA2563555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa