Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe
- Size 28KB
- Sample261002-lae2baeg66
- SHA256 1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc
- MD5 bcb1e4807d1af57f6825c4c1d15ea089
- SHA1 ba2d252ecf18af659c8774d76ee67e613f5ff125
- SHA512 77eaa441e632218c850a63b391d404bb93f84e51d039fe288c6d0b594fa0d72b6334caf8c29cd52d63e42688ca66a604200e99d263f134d3632d057d5f14fd20
- SSDEEP 768:apypWCuvOw6CMLy73585veICaNb0/YHTELsceNnaCO:XE5L73UhCaFmDIVNaCO
- TLSH T185D25D83F794C42BD0B61670047546A6F73DAE714E2DCE2BE974339D6D30D82AD7A244
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e00000001c4c8-1.dat acprotect - Loads dropped DLL 1 IoCs
pid Process 4144 regsvr32.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0354731F-950C-4A53-BC2B-132B5EE6B0FA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\ = "912525 helper" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\NoExplorer = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\NoEEYTR6 = "1" regsvr32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\912525\912525.dll jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe File created C:\Windows\SysWOW64\algg.exe jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe -
resource yara_rule behavioral2/files/0x000e00000001c4c8-1.dat upx behavioral2/memory/4144-3-0x0000000010000000-0x000000001000E000-memory.dmp upx - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Firefox\searchplugins\search.xml jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3632 cmd.exe 5720 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "http://windiwsfsearch.com/ie6.html" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://windiwsfsearch.com" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\SearchMigratedDefaultName = "Search" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\SearchMigrated = "1" jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regedit.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchUrl regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\w regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL = "http://windiwsfsearch.com/search?q={searchTerms}" regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\SearchMigrated = "1" jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://windiwsfsearch.com/ie6.html" regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regedit.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Search regedit.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchUrl\w regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\w regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\w\ = "http://windiwsfsearch.com/search?q=%s" regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://windiwsfsearch.com" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://windiwsfsearch.com" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://windiwsfsearch.com" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchUrl\w\ = "http://windiwsfsearch.com/search?q=%s" regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regedit.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchURL = "http://windiwsfsearch.com" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchURL = "http://windiwsfsearch.com" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://windiwsfsearch.com" regedit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultName = "Search" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL = "http://windiwsfsearch.com/search?q={searchTerms}" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://windiwsfsearch.com" regedit.exe - Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr.1\CLSID\ = "{0354731F-950C-4A53-BC2B-132B5EE6B0FA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\912525" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr.1\ = "912525 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\ = "912525 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ = "Ie405mgr" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\ = "912525 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr\ = "912525 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr\CurVer\ = "w123.w123mgr.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\ProgID\ = "w123.w123mgr.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\ = "{E63648F7-3933-440E-B4F6-A8584DD7B7EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr\CLSID\ = "{0354731F-950C-4A53-BC2B-132B5EE6B0FA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\InprocServer32\ = "C:\\Windows\\SysWow64\\912525\\912525.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\VersionIndependentProgID\ = "w123.w123mgr" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0354731F-950C-4A53-BC2B-132B5EE6B0FA}\TypeLib\ = "{E63648F7-3933-440E-AAAA-A8584DD7B7EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\912525\\912525.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ = "Ie405mgr" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib\ = "{E63648F7-3933-440E-B4F6-A8584DD7B7EB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w123.w123mgr.1\CLSID regsvr32.exe - Runs .reg file with regedit 16 IoCs
pid Process 5728 regedit.exe 4248 regedit.exe 5824 regedit.exe 2400 regedit.exe 4748 regedit.exe 5924 regedit.exe 3008 regedit.exe 3852 regedit.exe 560 regedit.exe 4480 regedit.exe 4584 regedit.exe 1868 regedit.exe 3092 regedit.exe 5300 regedit.exe 2472 regedit.exe 1560 regedit.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe Token: SeDebugPrivilege 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1732 wrote to memory of 4144 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 89 PID 1732 wrote to memory of 3632 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 90 PID 1732 wrote to memory of 3092 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 92 PID 1732 wrote to memory of 5728 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 93 PID 1732 wrote to memory of 5924 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 94 PID 1732 wrote to memory of 5300 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 95 PID 1732 wrote to memory of 4248 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 96 PID 1732 wrote to memory of 5824 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 97 PID 1732 wrote to memory of 3008 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 98 PID 1732 wrote to memory of 3852 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 99 PID 1732 wrote to memory of 2400 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 100 PID 1732 wrote to memory of 4748 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 101 PID 1732 wrote to memory of 2472 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 102 PID 1732 wrote to memory of 4584 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 103 PID 1732 wrote to memory of 1560 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 104 PID 1732 wrote to memory of 1868 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 105 PID 1732 wrote to memory of 560 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 106 PID 1732 wrote to memory of 4480 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 107 PID 1732 wrote to memory of 3804 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 108 PID 1732 wrote to memory of 5720 1732 jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1d254465f7abda4a0a998d71564985b2e08090385eea3d54d444c0b3fa1135dc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\912525\912525.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4144
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3632
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:3092
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:5728
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:5924
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:5300
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:4248
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:5824
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:3008
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:3852
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:2400
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:4748
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:2472
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:4584
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:1560
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:1868
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:560
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\tmp2.reg2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs .reg file with regedit
PID:4480
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /F /Q "C:\Program Files (x86)\Mozilla Firefox\searchplugins\*.*"2⤵
- System Location Discovery: System Language Discovery
PID:3804
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\43566574.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5720
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2.bat
- Size 44B
- SHA256 34a62676cddefb89646d36ec3ec42a29e2180d5a0a203d1128056949f31490ac
- MD5 21bde25fe6e71bbb3510bf193c8c87e3
- SHA1 365f3e314ab9a2a970565b14ae01799c6e4e6af7
- SHA512 2a5cbaed642041710997f551928fcb7eff82aa8db67a98f7a67fd19b931fbce52050ff7f5fd98eba23271ffeb4fea6edc4dfdd1ba72ce3bc6e7709dfa0b84c6c
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\912525\912525.dll
- Size 15KB
- SHA256 d56f531151085a4f9f4389ac9bc07caf0bea03da55fea8c053dc75f7715eed8c
- MD5 101fcbd7ef691d86769222777a712d1d
- SHA1 c348554589f8a49737d99134b1064e6322f8197d
- SHA512 4dbdc2935346639f3256081e1ebc073b37cfd51dbc7566d7acdab505be2dc6e31997608f924bcb0e3dc68283513afaa95f85270f2f122922941772b1ed60d081
- SSDEEP 384:saNB5lsz/0IokaTELghH8EKCDpneLhH4:saNb0/YHTELsceNnaC
- TLSH T1A6627C82B7E880A6D5EE16B04E7283F36136FC618F3E9D1B785C33AEAC705445B55780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\43566574.bat
- Size 324B
- SHA256 143cd0db7092c752f2f8f85cbe471097372eb723f4da25757deabbe65bf674d5
- MD5 77df943492df423ec23d64a6ac97a346
- SHA1 749d48ef54013e6817e32f29ca16cd795365021a
- SHA512 c8c454386007659428798376d4a442ed91fb77fc7ff111722065aeb4f8939f1972b5690ec8d7b0b0a38b36bc02865507e32a98219d100f70acda78cef965e963
- TLSH T114E0CD59A485C60E44C4A85FC475364E92C63B683A8F3F644730D58C29D524DB6F7189
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 126B
- SHA256 2547beef3bf48aa7138d566ac6c3366f32582de70b00e8d2c0644d025e668b13
- MD5 06f6acb3b77b5bd23cab760dc6132a70
- SHA1 e1862516db7c2ee1a66826b35f8332dba88d8fbf
- SHA512 491fbe22672bf8db196cae0a44375552b53996b976221ab6cdbaee531c0e8aa024ea9e61d5463e19929ccbc833c1a2b23b5b5f88392764c999cc811436a8a661
- TLSH T18EB09B646457411F64F27B3055C5B2D175D503EADD419DD5D90467402407D46E135297
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 118B
- SHA256 4f9297df3a73c79145c60e7f8982fa95976552dcb22821943a2489bc68ef18a4
- MD5 680045f8c7ae4b42813bd6715692f20a
- SHA1 5458d7f09d177fb06b4e4570272f0aedc7af2af6
- SHA512 3d89c15e8171401666388e2dd2a1467e636e03116ddfab24b7b13265574d4586c7838b7a8e63761dcc778871c17cf4f8ac821ccbcccd3fdf3d8c0a25c8ced852
- TLSH T171B09264A406552FA1B677246580A2C9759902EBDD828DE5E908AB402406D85913A2AA
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 119B
- SHA256 f393dee31f17f9650b4680f48d22092737632a773493bfbec086b6cc7f42f425
- MD5 d7a860996c1bad7b82888d1a6fcc126b
- SHA1 8c55a2f744a97f8ff57d106e5c2c6791c34feb1f
- SHA512 06b2ab2c604a379afbd14b7f6a8907744c71dc995897a06c23ca6522d0beef72405ed96ca45370e884fe364a42e1400f4676ed0a6c09c4848ab2e531a7a73b93
- TLSH T1EAB092656406451EA17666246AD0A2C8749902A7CE82CDE5E948AB403006DC6903929E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 127B
- SHA256 9b63284f86cfe0b78ca9fb9080b548687a8bd7a9fcc0594bc6eca4a05ee2d72a
- MD5 8e6e8ec1162c7824eaf2fafec86a60e0
- SHA1 fd9162e4c7a6025389cecf5264050e9598fcf455
- SHA512 3ce33e0a5653810a4ec792bc864e947763bc1fc8886a00c28661f314f510b90f49295a0c2f0439e6a0e9b0fe624f021afbeb0679e5c406276d6fa48ee35250b4
- TLSH T1DDB09B756457411E64736A3056D5B2D0749502B6CD41DDD5D54467413107DC7E03835F
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 111B
- SHA256 329d6e131ffdb3f4181863a258bac5100c5fb271729f6fb2cae3958980da1e4f
- MD5 cfbed83c95a642cfbc4626bec35c8483
- SHA1 8efcffeb7e2a288f6b1aace1d90c07fb9ac2d09a
- SHA512 ee25c4b8ffc78b401d97aa21deeb2881c97aa40ea7da1df4c1a7fb4328b0349985b51ddb4c5dd2599d95b62d1bceeedff8aad2c4bcc2752780ef7ce2cb69ef82
- TLSH T1E1B01294E406415F70B6772061D063C275DE12EBDC428DC7ED0867403406D81D3392E9
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 112B
- SHA256 9c8741faf5128aa3bd38579f05c92eb2c98a3b0a9431da3b8bcaa20a8fd623e0
- MD5 52125788250b95203990065de88a9c15
- SHA1 bcdab330257009810022c0c5bf1bdcb898cccd98
- SHA512 ade8416d55e6794c3fe591d293f2ba84ec2a6cb672c56ea442736e33ae9599133ef0833f6d3202f39df8f46a68b427164add2b9893f7e91b2160ab5d2d14bd3b
- TLSH T10BB012A5A406414F7037772067E063C174DE01B7CD42CDC7E944A7413006DC2D17C39E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 124B
- SHA256 6f3a6c903f692457fd86b93688daaeb11873e4b4640d8d1c629de2060ab9582f
- MD5 44045000a50bd4e81d3f9ad767b4b283
- SHA1 c5dc04d9a2120434921a661855bd7663890b841d
- SHA512 892adfc8b0c2fff3e4ba714e1db1800350ffa4cf29f37fce9815085c95a304059ca25f84b192767d865249a410214f33003fb406df3ecfcf1f8895f10a6053e4
- TLSH T156B09254A806522FA1B2676060C163C17A9903EBE8428EC5E959AA402407E82D1292F9
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 125B
- SHA256 81128976be75b4bb3b662ced4bf0de0c357d77dc4d55f3cf880f67b225c9fbed
- MD5 b6243afbeea3839ca5b089414454a76b
- SHA1 fdd38e671dbacd044e7974fd2dfc831fcbb4e19c
- SHA512 37d02aa454bb559885696d4095d457a904a3777e6d3777c044bf0beef883c9ac2fb47ba054c26cfcff9815f54ae826542e4b28490d2e3491646a21c42113c299
- TLSH T1B9B092646806421FA173676066D163C0799902A7C9428EC5E999AA403007EC2D0382AE
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 126B
- SHA256 4b33f4f6393e38f9d7abd1046bb8df9635402e8b10504ed6862fc8c30d5be72e
- MD5 4fe7f6d8c0ae1a085b5282454fa66a14
- SHA1 d21a9981c8c37877ef2379e9300d9138d76a78e0
- SHA512 bd8d3f4666159dcfef68343d8ce6fd4cb53572ce694666dc88541e545361331ca361814817825112a3470fbcabfc4e0cf1d390675526dba08b43d7f205f72686
- TLSH T1E6B09B55E456521E9471F76120C162C1659505D7D4435DC7DD9517006407D8181151A9
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 127B
- SHA256 cb16f6f07b24eab150d349fe030fba33eaf50f87d9b472eed8f43e40fdc79afe
- MD5 390e8ceaaece7e66f2214fc663cf0994
- SHA1 74ac6c1482d715bab8829548ec2a08529ee27037
- SHA512 e5245072184865cb7247a40cb599b228593c44f6be87a2e5e60bb71f0909814119f96583eae1d9bf79390ff6d09e68d43e991c159fd4a53266f941ab69ece970
- TLSH T1AFB09B65A456421D9432E76025D162C074550567C4439DC7D9D517007007DC2802825E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 154B
- SHA256 ab1f38e1198ebf1104a549256663032ca3985b81d5d2ca2003a200e98cbd195e
- MD5 5fd0720b4a7daafc4b948fdc3b5ce5ab
- SHA1 ae7ff5f2bd9d5bbf9e4d9327fb00bf0af25912e5
- SHA512 53ae4c816d799b8ff54d217517bad8ba586d7997f337faa8b3dcd653090ef1f17011579e5f4c3255e1d774e502275e2cb4019dc0e3345c79e6735b4f40cc46de
- TLSH T196C08C20A041C15AA0B1B7202080A280259252DBDC029CE9DC885B04240BE8A90392A6
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 155B
- SHA256 4eb0597b0ddd52274cfdc8fdb89c95fb0fff2553ebc7777821d3810144458079
- MD5 8d60e5b847a27c1cc33a14af129cf73f
- SHA1 8d27c40dc06d064fcd1003f908080e9323fc6c3d
- SHA512 ba86f3ac1800e69947e2861167a7f0756d32e1b581526c2293d863da2d53a04453c08c6a62170a0c90a7597ac2566d9f224a2c2e59c8e0e6c6fed9d82cdb2641
- TLSH T149C08C21A041C14AA032A62026D0A280249241A7CC02DCE998C89B04200BECB903C2AA
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 113B
- SHA256 a93a576c0c417ba44ea64077cd59415a18ddd8187a8b2cca324664a7e669afcf
- MD5 13023df788927722accd9c5b57a2c4fd
- SHA1 ea537acc2a137fac5298811da16a2064d3f0adc7
- SHA512 0775a4fe3c65cd68d3d86500cd4cae4ea0d97476c2e893078c0b3c2a133736e4b4b4d2a8e2d40ff599d594a4218d1078ea332386027a1bcbf62dd8d5182c4c9e
- TLSH T1A4B09220A516C61FA2B33320A69091C1268216999C02ADD8E888CB40240BC48613E2EA
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 114B
- SHA256 97b30be7c6c21ed400299fcdbbdf30916b16a194c97b7a02535b28545c6f0d84
- MD5 c8f7a37f614ac92a6c3180a3544ab3b1
- SHA1 7e0983d6273df1f092686ad1653fbbe0841ba362
- SHA512 500c3bb15f492aa4188d17fab8c4870a8e42c3e34f88e89ad235cda5e471bd831de16534fa0093b9af825245512700b23312409723537dcaf82f4251829973c9
- TLSH T1FBB09220A516C60FA2732320ABA091C0344206658C02ED98E888CB40200BC89603D29E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 125B
- SHA256 6b7a72ec09799c693fd7d763c5ce0e8090f67ef861d6c363dd900c8df80599cc
- MD5 9da31f1feb14d78beb5d0dc9e32c422a
- SHA1 f125208ec68f3b57de9880b3aec7b2aa4db46ed3
- SHA512 4b4d2ba3d5e3795d402f57afeb984ecbcf9c162d1dce07888531fc5cc2109acb3f8a29f383f6d8cf5d58c4262542e5e5bbf3ab4f33f81de3e9d1dce31469e0e5
- TLSH T1E5B02220B003802AA0B23B202082A3C0B8C802EBCC028CC0E8882B00200A88280382AA
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\tmp2.reg
- Size 126B
- SHA256 671f19355fe172dbc20426009794bd79cbba03bf49b4e9d2f7bdab5721925771
- MD5 8c77a91130f32ffd16793bdd036cad68
- SHA1 23b4db6485cef8fc6ad0d1962f653431b8d1972d
- SHA512 d3ef7c4484728f69914ddab9620d5cfa1cbe324d7baa5d02afdef80787ac97d7fdc76a6a25380868f68290cc9368e6ed39b65c109db4bd1c52fde53237e9a7d5
- TLSH T128B092757457811EA1726A242AD6A3C0B89942ABCD52DDD5E9942B42310ADC6803839E
- MD5 SHA1 SHA512 TLSH