4799ad9f38b0233b64b8a675ba67a14988c2be3a36e50140b136c55cf585b810

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0a94fa88917463ade3432563abff492_JaffaCakes118.exe
Size 80KB
Sample240415-kdaekaac94
SHA256 4799ad9f38b0233b64b8a675ba67a14988c2be3a36e50140b136c55cf585b810
MD5 f0a94fa88917463ade3432563abff492
SHA1 37ae1c4b8670adb519a5c98ff29d7f19f7e449c1
SHA512 c3343c8d9bb470ab6cfaa97f60a9390c4f002745476e5fdb59f3ac93e81bdc2b6ab8162bb6b262ee404876638b3a1d9e12b3b35af23e89fb80206652ed4bd4fd
SSDEEP 1536:EIStjt6ToC5fxPqcOEmQMYXnewWivACoSe9BbX8AFMjtf0sziudhuqqtMPVd+TY2:55L5JP+PRitUvX8Hmszvdh2tuVoEkT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4524	sxe83D8.tmp

Loads dropped DLL 2 IoCs

pid	Process
2900	f0a94fa88917463ade3432563abff492_JaffaCakes118.exe
2900	f0a94fa88917463ade3432563abff492_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}	sxe83D8.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscorews.dll	sxe83D8.tmp

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\TypeLib	sxe83D8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\TypeLib\ = "{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}"	sxe83D8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\ = "mscorews"	sxe83D8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\InprocServer32	sxe83D8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}	sxe83D8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\InprocServer32\ = "C:\\Windows\\SysWow64\\mscorews.dll"	sxe83D8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	sxe83D8.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	sxe83D8.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\InprocServer32\ThreadingModel = "Apartment"	sxe83D8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4524	2900	f0a94fa88917463ade3432563abff492_JaffaCakes118.exe	78
PID 2900 wrote to memory of 4524	2900	f0a94fa88917463ade3432563abff492_JaffaCakes118.exe	78
PID 2900 wrote to memory of 4524	2900	f0a94fa88917463ade3432563abff492_JaffaCakes118.exe	78

C:\Users\Admin\AppData\Local\Temp\f0a94fa88917463ade3432563abff492_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0a94fa88917463ade3432563abff492_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\sxe83D8.tmp
  "C:\Users\Admin\AppData\Local\Temp\sxe83D8.tmp"
  2⤵
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sxe83C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\sxe83C6.tmp
Size 15KB
SHA256 b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76
MD5 bd815b61f9948f93aface4033fbb4423
SHA1 b5391484009b39053fc8b1bba63d444969bafcfa
SHA512 a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71
SSDEEP 192:Gi7Nr+Dlkv5oGxoSfZ7TAapVJZOO0i76HnGlj+fzARyUeDA2fLBWR:ByDlqZgsPwy+fztUmT9
MD5 SHA1 SHA512 SSDEEP

Submit Download

sxe83D8.tmp

Path C:\Users\Admin\AppData\Local\Temp\sxe83D8.tmp
Size 152KB
SHA256 e776807e089b866575c6c7a80e65762ed1f5c6beca5b0545636cad27f6f72790
MD5 f722de53e7fffed004aea381ac288f01
SHA1 d6a947522f04bd4ffe94b0b9d5ccdeef896e4c24
SHA512 e777dd471f99e523b853606c81bf51e2d64191f72acf42fc3cadee621d02169b96580b02f5ad4ff3cd9ee24f117c741a13080e149ed82e8d3c6aa5dc7e478970
SSDEEP 1536:SAJs3AaNADUXOYuL5T+6orxTb16WPFGVjMXsZqht5fAi1F5HMnoNH:SKmNADUXgLh+n9RoSXsZ25VQno1
MD5 SHA1 SHA512 SSDEEP