Analysis
-
max time kernel
95s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_002edc6b7084635d18a9d05694ef71b8.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_002edc6b7084635d18a9d05694ef71b8.dll
-
Size
284KB
-
MD5
002edc6b7084635d18a9d05694ef71b8
-
SHA1
805c8e588d8e745ef837daaa20b779397d39b983
-
SHA256
8fe87ee3e6dbaa468584811b2f52c8eedc1c8e534cbb693d132e552d2eb78404
-
SHA512
634c02c2ecc0d03a75d13156a6f0169eac6b805dcc19e07a9e4ead954fff29fad44cade0978365595d7f7accdfa1e29034d4eaa94d929c85589da5a2499c8c4f
-
SSDEEP
6144:zKtDP9elqi0AOROnJPmR2wl30kVYvtrx:zKtYlqi09ROnJPmRPV0ZV
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 3344 regsvr32Srv.exe 3500 DesktopLayer.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32Srv.exe regsvr32.exe -
resource yara_rule behavioral2/memory/3344-6-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral2/memory/3500-13-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral2/memory/3500-15-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral2/memory/3500-20-0x0000000000400000-0x0000000000415000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px6B5C.tmp regsvr32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe regsvr32Srv.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4508 1212 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32Srv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444181109" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3EE12516-D787-11EF-AF2A-E6FB6C85BB83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "326631137" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157140" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "325067957" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{465A6059-DA60-49DC-90A3-DF407297CC9A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{465A6059-DA60-49DC-90A3-DF407297CC9A}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{739022A5-2615-45BF-A30A-AEC6C70B049B}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89698CC5-DD69-4F34-BDCA-7FA190FCAA37}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{183D4C60-0A32-11D4-B052-00409575855B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LogonMgr.LogonManager\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2E73E231-6A73-429F-AC58-4592BCCD6AC5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84E87512-7776-4F59-B119-165DEE47E60A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FE67D45-34FE-4305-896B-19FB6C355A80}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79867DC0-0AE6-11D4-B052-00409575855B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79867DC0-0AE6-11D4-B052-00409575855B}\ = "ILAN" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F45FE87-19D5-45E3-9207-06AF2BAA93D3}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A6A09A1-32E9-4293-9E1D-1E131806E801}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F5E6FB2-D765-458E-BE53-031AF5E4269B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{465A6059-DA60-49DC-90A3-DF407297CC9A}\ = "IConnectors" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{183D4C60-0A32-11D4-B052-00409575855B}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF262B62-CC1C-4FB9-AB52-5B54AFA357EE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96144532-C2BD-409D-8F3E-F2EFEDA7B4FB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3BE8465-5CFC-4C65-8AEC-AC50C2CCA89D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3BE8465-5CFC-4C65-8AEC-AC50C2CCA89D}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89698CC5-DD69-4F34-BDCA-7FA190FCAA37}\ = "IConnector" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD27FE13-A289-4439-9A62-9ED2278A7CA9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{183D4C60-0A32-11D4-B052-00409575855B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93278B81-3743-4DB1-A6F7-ECAC01FFED1A}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2F5E6FB2-D765-458E-BE53-031AF5E4269B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84E87512-7776-4F59-B119-165DEE47E60A}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{465A6059-DA60-49DC-90A3-DF407297CC9A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CFA9F37-6669-4D30-9054-CE38A8D74233} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF262B62-CC1C-4FB9-AB52-5B54AFA357EE}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F5E6FB2-D765-458E-BE53-031AF5E4269B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DAC7F6A-8BD2-4816-8283-9BEAB56D8739}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED18E0CA-6A5C-4DCC-BA33-2B1BC4420A57}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96144532-C2BD-409D-8F3E-F2EFEDA7B4FB}\ = "ILogEntry" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0AE2345-D700-4B48-97DB-A12506966B3C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD27FE13-A289-4439-9A62-9ED2278A7CA9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4894f79-8121-4df2-b79e-ed73fa8ade6f}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_002edc6b7084635d18a9d05694ef71b8.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{465A6059-DA60-49DC-90A3-DF407297CC9A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FE67D45-34FE-4305-896B-19FB6C355A80}\ = "ILogonNotificationListeners" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FE67D45-34FE-4305-896B-19FB6C355A80}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89698CC5-DD69-4F34-BDCA-7FA190FCAA37}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD27FE13-A289-4439-9A62-9ED2278A7CA9}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79867DC0-0AE6-11D4-B052-00409575855B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79867DC0-0AE6-11D4-B052-00409575855B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FE67D45-34FE-4305-896B-19FB6C355A80}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3BE8465-5CFC-4C65-8AEC-AC50C2CCA89D}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3BE8465-5CFC-4C65-8AEC-AC50C2CCA89D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED18E0CA-6A5C-4DCC-BA33-2B1BC4420A57}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0CFA9F37-6669-4D30-9054-CE38A8D74233}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79867DC0-0AE6-11D4-B052-00409575855B}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93278B81-3743-4DB1-A6F7-ECAC01FFED1A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A6A09A1-32E9-4293-9E1D-1E131806E801}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF262B62-CC1C-4FB9-AB52-5B54AFA357EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84E87512-7776-4F59-B119-165DEE47E60A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0AE2345-D700-4B48-97DB-A12506966B3C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93278B81-3743-4DB1-A6F7-ECAC01FFED1A}\ = "IPassportCallback" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD27FE13-A289-4439-9A62-9ED2278A7CA9}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4894f79-8121-4df2-b79e-ed73fa8ade6f}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FE67D45-34FE-4305-896B-19FB6C355A80}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{739022A5-2615-45BF-A30A-AEC6C70B049B}\ = "ILogonNotification" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{183D4C60-0A32-11D4-B052-00409575855B}\TypeLib\ = "{2E73E231-6A73-429F-AC58-4592BCCD6AC5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79867DC0-0AE6-11D4-B052-00409575855B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F45FE87-19D5-45E3-9207-06AF2BAA93D3}\ = "IDunConnector" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7D5F98A-8248-4144-A86F-19E3A0C46955}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7D5F98A-8248-4144-A86F-19E3A0C46955}\TypeLib\Version = "1.0" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3500 DesktopLayer.exe 3500 DesktopLayer.exe 3500 DesktopLayer.exe 3500 DesktopLayer.exe 3500 DesktopLayer.exe 3500 DesktopLayer.exe 3500 DesktopLayer.exe 3500 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1668 iexplore.exe 1668 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3160 wrote to memory of 3404 3160 regsvr32.exe 83 PID 3160 wrote to memory of 3404 3160 regsvr32.exe 83 PID 3160 wrote to memory of 3404 3160 regsvr32.exe 83 PID 3404 wrote to memory of 3344 3404 regsvr32.exe 84 PID 3404 wrote to memory of 3344 3404 regsvr32.exe 84 PID 3404 wrote to memory of 3344 3404 regsvr32.exe 84 PID 3344 wrote to memory of 3500 3344 regsvr32Srv.exe 85 PID 3344 wrote to memory of 3500 3344 regsvr32Srv.exe 85 PID 3344 wrote to memory of 3500 3344 regsvr32Srv.exe 85 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1212 3500 DesktopLayer.exe 86 PID 3500 wrote to memory of 1668 3500 DesktopLayer.exe 91 PID 3500 wrote to memory of 1668 3500 DesktopLayer.exe 91 PID 1668 wrote to memory of 1384 1668 iexplore.exe 93 PID 1668 wrote to memory of 1384 1668 iexplore.exe 93 PID 1668 wrote to memory of 1384 1668 iexplore.exe 93
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_002edc6b7084635d18a9d05694ef71b8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_002edc6b7084635d18a9d05694ef71b8.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\regsvr32Srv.exeC:\Windows\SysWOW64\regsvr32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 2046⤵
- Program crash
PID:4508
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1212 -ip 12121⤵PID:936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD50ada2095c461df5a751955aa41dd491e
SHA18366c54b31e1ddc8016aa22aab8c83f73c690810
SHA25680cd542688ed3a45669b53243c3f4922d6eb21a34d8dfeebc6c101484d3bac09
SHA512135991affe343d4358bb15a693effa7a6813d6715e555729d2aa04a98555e13fded55d3100a41a92a5beb57c68fbdacb199a3e66407944e37880b28d42d79e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5080395802c3c6b3f6f754318816fcd58
SHA1563f155d3ee734a8946e9d716c327250b0892d08
SHA256ee93f93747e0960739abe95659c43c924c8b64f4e8b61cdc6dae5a3556a9dc75
SHA512e4840991ca6eff1ce1ad5f24d6dd954c0df10f4d70acc60e76b1ca5ab0c61db16b01919fd594dff3236479557bdbd54a5490d913648eb40244a9aec0ec30497d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
58KB
MD524f14847e1e9b7a4dcbd77816d3ea8a4
SHA1a172b22bd35f2aa8e7b9788a075ab2e3da87b2a4
SHA25698c494dd67af59ab86bf136d1af3e5351155bac8901b4ed0953afde478aa5cd1
SHA512ab76c729209ba44d9618131fb65ebb7daed8123a0625c34832039f8364fb2d56a89780fda7f7fe4ca06a7b95afb0f7c389453ea410ef846a6e1b762b316ac127