76901592ebd1371aa3abf40f63c577315e81c5b4c243abd96465ebbba90964b5

General

Target
e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Size 9KB
Sample240407-vtvqjsaa26
SHA256 76901592ebd1371aa3abf40f63c577315e81c5b4c243abd96465ebbba90964b5
MD5 e572ffcb48a531e7b4469f634fab6351
SHA1 0b81d4bf29cb87edf76abc67d1a86ebcc5f873a9
SHA512 f51347ef7b0545165c2b975996c763ef09ad712e81be7c88547d507c52b920cd3fe2d773b831401713162237d9ece827584129eb4d519d8cd1ac0105ab28b9d3
SSDEEP 192:9QSVH267JKyoHCguw2TwIa2uZNLhKKZX2boCQzHQjb2+YWqt:uSVH267F62SPZXC08jbx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware evasion stealer trojan

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.google.com/ie"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.google.com/ie"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3748	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
3748	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3748	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
3748	e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e572ffcb48a531e7b4469f634fab6351_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Windows security modification
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
1⤵
PID:2492