Overview
overview
7Static
static
3f0afec022f...18.exe
windows7-x64
7f0afec022f...18.exe
windows10-2004-x64
7$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...pt.dll
windows7-x64
1$PLUGINSDI...pt.dll
windows10-2004-x64
1$SYSDIR/ad...ve.exe
windows7-x64
7$SYSDIR/ad...ve.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$_5_.dll
windows7-x64
6$_5_.dll
windows10-2004-x64
6Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
15/04/2024, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsBrowserOpt.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsBrowserOpt.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$SYSDIR/adzgalore-remove.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$SYSDIR/adzgalore-remove.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$_5_.dll
Resource
win7-20240221-en
windows7-x64
General
- Target f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe
- Size 331KB
- Sample240415-kp2cesda2v
- SHA256 f02074eeb1cba11ac24a507940543b0ffb18121b7a23a556bfb53e0c74a8fc84
- MD5 f0afec022f8492766bfefd0d07ef8abf
- SHA1 45d06e99fa1f60b461a4f7bf80f1c96bc3d010eb
- SHA512 c7bd8afaf24a0717c99a05b5fc3b6c4069902a9e70c68ac9cd5c2cf8328aeed8cfffe8f456acd1fbf5a6c117bc8473f38e3ebd12df88ac6b05727cab60903dcd
- SSDEEP 6144:WXTN626ii5qvbmh/Jv9khqOHl/DaNq8dMdfwMhUDL3dRjCANctUcmRYXul9hgDh:6qUcMqwl/DaNqfwMECAKytll9hgDh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 18 IoCs
pid Process 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe 928 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48955792-5def-1512-197b-8ff3172ceb3b} f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48955792-5def-1512-197b-8ff3172ceb3b}\NoExplorer = "\"\"" f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\nss6777.dll f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe File created C:\Windows\SysWOW64\adzgalore-remove.exe f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Software\Microsoft\Internet Explorer\Main f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48955792-5def-1512-197b-8ff3172ceb3b} f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48955792-5def-1512-197b-8ff3172ceb3b}\ = "adzgalore" f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48955792-5def-1512-197b-8ff3172ceb3b}\InProcServer32 f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48955792-5def-1512-197b-8ff3172ceb3b}\InProcServer32\ = "C:\\Windows\\SysWow64\\nss6777.dll" f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48955792-5def-1512-197b-8ff3172ceb3b}\InProcServer32\ThreadingModel = "Apartment" f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
PID:928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsc6718.tmp\Math.dll
- Size 66KB
- SHA256 8a8d78657f0f6b44f18b16e7eea3e62eef6720e04cd2efc820d62bbe987afac1
- MD5 468914ab4ea3afc6fda29031c758394e
- SHA1 d3b632778a03567efa761401151bfe80d0fe956c
- SHA512 0b3df17a3a17a82ba7092ff384c7d820d9f1103fcfa732fb399cf0ff065ec6913a73bea433e19ad787bccf272059e39d196322445d9a6327bb25738f343926ce
- SSDEEP 1536:zPyr/G6SdHg4amq2MwtmIuqFVxL9NvImlRo:z6AHg6bH5lq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsc6718.tmp\NSISdl.dll
- Size 14KB
- SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
- MD5 997ae296af5b7ca9aaa52f6844075439
- SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
- SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
- SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsc6718.tmp\System.dll
- Size 10KB
- SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
- MD5 32465a07028b927b22c38e642c2cb836
- SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
- SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
- SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nss6777.dll
- Size 306KB
- SHA256 b7f8e9c663515cc1e1deaddabe285959c668ffc6346d82ae97e35f021d30afa9
- MD5 dc21e047a5c144e913f368423786d6cc
- SHA1 272ae16afdbe0994ad797996ede07b8e045ca036
- SHA512 301689078e21b17ae27e5a4e6f3235510b0c3ec2d1ec022ba5ac0c1b12e4e0bbf18d538a0ee362b39a0ad8667223c15f2b2a7e7a2315bbcdbd73545582bce9bd
- SSDEEP 6144:x5kv9YzFPA0N7azcPFqR5pTE714TB/9VfzhiN:x5kv9YNDgzcP6C714T19Vfzm
- MD5 SHA1 SHA512 SSDEEP