Analysis
-
max time kernel
104s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 16:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe
-
Size
62KB
-
MD5
8ad751aa4eec7e08698f5e63240a2f35
-
SHA1
1774bb0a097ef5e152d11812ccc6a1b00799919c
-
SHA256
9b3c25d13ed5dde35e2007cce55d6e1a84b1457b7195f45778fae945fab74137
-
SHA512
a74dd9e05fab7f699df6e71aed64ebd9765b2596f9fa3bb5e9e8190d633331f1957a1f1c6a1e6e52fa6190fa081a7d5f3e43e55a56ba288150706b067a5ca691
-
SSDEEP
1536:zwXVn7kDcuaXa5H5udrqFyTWtLEfjr0mXbAG:UXhugCHeOJtQjr0mXbD
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E14DCE67-8FB7-4721-8149-179BAA4D792C} JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\epzbm6r346.ini JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe File created C:\Windows\SysWOW64\del32.bat JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe File opened for modification C:\Windows\SysWOW64\wsock32.sys JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe File opened for modification C:\Windows\SysWOW64\epzbm6r346.ini JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a025d0c9ff9fdb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F5074713-0BF2-11F0-AF5D-F25D982E6656} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4ec966183fcbc45999aac05eefc7ee700000000020000000000106600000001000020000000ecc10f13762e73d4e4e863b2720c1065964ab5e0c1d855d72cc4850714e9e694000000000e8000000002000020000000453334efb372aeea6df6137f746fe804641adc1f90b61e6a33b1c17172c3043b200000004f79562472a33289adce3f172a65a8eb6a2c01347bc0cbdd2d005bc5d68ef87f40000000e23bf2437a6e955164a10a223ed493d5aafc6937852a900d7582ac7e4914882b2d712c7637d7403509d1df4823ab83da4cebe50a17aab57dacbb698163cf277a IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449944831" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e0d4c9ff9fdb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4ec966183fcbc45999aac05eefc7ee7000000000200000000001066000000010000200000008bca84bc35f944bb7a66e7b327aca750c1e91b6332558ad7034038d4eefe04f1000000000e80000000020000200000008ef64a3cb198e52592720009e0c0b2819e1cfe990392353342f95ac2218e7faa20000000bf31ea229e2c4e722e6be1f54f8fd36a4a084fe5d947f9e69dca3f636d079aa440000000f2b6e20e75ad2a6a866826370262e3914fcf7cf016f52db08658c222d5b3e401299c07d29976a54b56ad1e2320043b2cf63b6811d1eda56b485f832a400d2d32 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Modifies registry class 42 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\TypeLib\Version = "3.0" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\InprocServer32 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\InprocServer32\ = "C:\\Windows\\SysWow64\\wsock32.sys" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\InprocServer32\ThreadingModel = "Apartment" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\TypeLib JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\N.Cs4 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\N.Cs4\Clsid JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\0\win32 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\TypeLib\ = "{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\0 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ = "_Cs4" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\N.Cs4\Clsid\ = "{E14DCE67-8FB7-4721-8149-179BAA4D792C}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3} JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\TypeLib JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\HELPDIR\ = "C:\\Windows\\system32" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39} JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\TypeLib JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\TypeLib\Version = "3.0" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ProxyStubClsid32 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C} JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\ProgID\ = "N.Cs4" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\VERSION JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\FLAGS\ = "0" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\VERSION\ = "3.0" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\N.Cs4\ = "N.Cs4" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ = "Cs4" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ProxyStubClsid JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\FLAGS JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\0\win32\ = "C:\\Windows\\SysWow64\\wsock32.sys" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ = "_Cs4" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\ = "N.Cs4" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\TypeLib\ = "{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E14DCE67-8FB7-4721-8149-179BAA4D792C}\ProgID JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\ = "N" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}\3.0\HELPDIR JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ProxyStubClsid32 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\TypeLib\ = "{C9F1C5A0-F3D8-48E2-8B8C-3E86B4CAC7E3}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39} JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0958C4C9-77B0-4AA8-9364-7886BFCA7E39}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5788 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 5788 IEXPLORE.EXE 5788 IEXPLORE.EXE 4696 IEXPLORE.EXE 4696 IEXPLORE.EXE 4696 IEXPLORE.EXE 4696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5924 wrote to memory of 3144 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 89 PID 5924 wrote to memory of 3144 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 89 PID 5924 wrote to memory of 3144 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 89 PID 3144 wrote to memory of 5788 3144 iexplore.exe 90 PID 3144 wrote to memory of 5788 3144 iexplore.exe 90 PID 5788 wrote to memory of 4696 5788 IEXPLORE.EXE 91 PID 5788 wrote to memory of 4696 5788 IEXPLORE.EXE 91 PID 5788 wrote to memory of 4696 5788 IEXPLORE.EXE 91 PID 5924 wrote to memory of 4716 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 92 PID 5924 wrote to memory of 4716 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 92 PID 5924 wrote to memory of 4716 5924 JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ad751aa4eec7e08698f5e63240a2f35.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Program Files (x86)\internet explorer\iexplore.exe"C:\Program Files (x86)\internet explorer\iexplore.exe" http://2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5788 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4696
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\del32.bat2⤵
- System Location Discovery: System Language Discovery
PID:4716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize471B
MD50c5ef9158dcdd3b41a7e84c5e760b59d
SHA19cb930588b30e4399d0fbf73a559b2d89373a6a9
SHA25695c2b916d5668f7823fc9222d4cac008570c4f1866a3ef2b4175cb1ea5bbd9d9
SHA51213cf19b192d4b6365ab09e13b5ffc6c26470ff51527d8e49fad7aa410df5a7bc6557e731d5b49fa7c19cd9b677764422d2f57c10d2578cdfdf91cd1120db9c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize412B
MD5a67f5c0f466c1133a4db322894bc70ad
SHA1ac748e8ae942716c73b2df7dee7ece22a1019f3c
SHA2568a7842a0f297d1ba8f44aff170182861fbd02c3141d6ebe2c9f8ed2a2ac41cde
SHA512578407ad329a68973da3a4b576dcb5a73c6ffdd3d049084f81606dd6d09dc2c63d9eadf7f984bbd41bdd89db86bc9a2c3002a0c184970b472a11aaa8f0743e30
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
174B
MD5b69fe5fa220d7b3cc04a493615a4bdc3
SHA1d0f3df7a4cbeba8ddbde30f55865d7eb9bc89be0
SHA2563c2cfb4ee0e522c4983027fa7305fc0846c26bc988c678188fe360ee685897d3
SHA5121cb8dac2a9a112c0d73044346818f9ec929966a615b031f4d31ccda98c3d15484388779b7be71fa379e2f01d637f54a461782afd166bc3cee48a9446e365f1d3
-
Filesize
159KB
MD5e542cc1875d57544eb2382faf41573b1
SHA1e23d5915349d5772f23180dfa2c2cac2c0b8d14e
SHA2560a907a6bb00f24dffa890786c2b0ac06bfb09a9bd79294c1181957108ba828ac
SHA5125c59a3532e6fe273e954a5161cc095be463377426cb4c6f948d566f833ba7558b437742fa5ee261f7dd31c611ce2bc8092df6ad04f1dc50ed4d0118c75f59468