Overview
overview
8Static
static
7201b3ddbae...18.exe
windows7-x64
3201b3ddbae...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3CCleaner.exe
windows7-x64
7CCleaner.exe
windows10-2004-x64
1Microsoft.mshtml.dll
windows7-x64
1Microsoft.mshtml.dll
windows10-2004-x64
1cafw.exe
windows7-x64
7cafw.exe
windows10-2004-x64
3cladgenius.chm
windows7-x64
1cladgenius.chm
windows10-2004-x64
1decaptcher.dll
windows7-x64
3decaptcher.dll
windows10-2004-x64
3fbclient.dll
windows7-x64
1fbclient.dll
windows10-2004-x64
1holfix.exe
windows7-x64
8holfix.exe
windows10-2004-x64
8ibprovider.dll
windows7-x64
1ibprovider.dll
windows10-2004-x64
1icudt30.dll
windows7-x64
1icudt30.dll
windows10-2004-x64
1icuin30.dll
windows7-x64
3icuin30.dll
windows10-2004-x64
3icuuc30.dll
windows7-x64
3icuuc30.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 16:58
Behavioral task
behavioral1
Sample
201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
CCleaner.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral12
Sample
CCleaner.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Microsoft.mshtml.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Microsoft.mshtml.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
cafw.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral16
Sample
cafw.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
cladgenius.chm
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral18
Sample
cladgenius.chm
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
decaptcher.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral20
Sample
decaptcher.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
fbclient.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral22
Sample
fbclient.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
holfix.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral24
Sample
holfix.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ibprovider.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral26
Sample
ibprovider.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
icudt30.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral28
Sample
icudt30.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
icuin30.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral30
Sample
icuin30.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
icuuc30.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral32
Sample
icuuc30.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
ibprovider.dll
-
Size
3.1MB
-
MD5
3bca69f43800aed83c069037b8efd9f7
-
SHA1
d6387c347b1614979578c3442ec948e3d69d73d3
-
SHA256
278d40f010c994a458b076d1aa4dec03f3891da394d707a254908a7afabd51b1
-
SHA512
83b81cfc1c2291c0a5478eb600eb3edb15cf2346a3293e9292584f981df11b5ef678962f2b73aa48ebf4a6f59021d5facde0b93565fba0a47c24c3919a7f67bb
-
SSDEEP
49152:TX9oxIdkM+x1VKRANMvTA1wAwspjG/HBFIt/M8xc878qLKXZYemFFU+tEyqhguij:ja1Q/g2MtEs
Malware Config
Signatures
-
Modifies registry class 53 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID\ = "LCPI.IBProvider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ibp\ = "LCPI.IBProvider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll,1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer\ = "LCPI.IBProvider.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Data Link Page [v3]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\flush_log_period = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID\ = "LCPI.IBProvider.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ibp regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLEDB_Services = "4294967295" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version\ = "3.0.0.8628" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\ = "Extended Error Service" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command\ = "notepad.exe %1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Advanced Data Link Page [v3]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe PID 1752 wrote to memory of 2188 1752 regsvr32.exe regsvr32.exe