7bf834c098aa6bbb8e2aaff60f508d2732f44f3407dea201d5b5dc95ec7a5fd0

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Size 57KB
Sample240415-dkhk7ada29
SHA256 7bf834c098aa6bbb8e2aaff60f508d2732f44f3407dea201d5b5dc95ec7a5fd0
MD5 f027085d3bcedc12976026e68afc2909
SHA1 179d4bbaa0fdb55e485dc075984889c0a8c45cc9
SHA512 0d070c7bda7892132342f312a0922e95dffd5357a4355b478039f0066bc56501c5b5bde12289aa96f7314a046bae614fbad01d182e9082e7411b96d6dd9f5479
SSDEEP 768:Hl8u2CSmJXid+XZlelh/YlmOaUOOhOhwS+FkmoD20ertOnsRARblC4r40OEXAfU4:M+XigDy5jlhwSykZ2/GNlC5SYyvJbJe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kaxs.dat	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rbsgam.dll	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\ = "Rmn plugin"	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\TypeLib	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\TypeLib\ = "{43F108CF-4818-4468-8C7A-5F32FC8F6A8D}"	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\InprocServer32\ = "rbsgam.dll"	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\InprocServer32\ThreadingModel = "Apartment"	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\ProgID	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\ProgID\ = "RITLAB.1"	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BEEFD1C-446F-48a7-A7C7-C8E5986A9760}\InprocServer32	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2136	1604	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe	86
PID 1604 wrote to memory of 2136	1604	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe	86
PID 1604 wrote to memory of 2136	1604	f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f027085d3bcedc12976026e68afc2909_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F02708~1.EXE >> NUL
  2⤵
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads