c82d2589aba9589742206df7f8ae28c9304b2ae710a6afd2ef659ebb60b87fb9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Size

192KB
MD5

f74d775faf7f38d45139c4d0a660bd83
SHA1

c98add460494e3a78ca45e48ad2f5b5b66ceae73
SHA256

c82d2589aba9589742206df7f8ae28c9304b2ae710a6afd2ef659ebb60b87fb9
SHA512

f4519249b92351da83ace16f3f12bea1b84d32a7134511b3a64d932d6a07cf4db3485d6b98330ac062f3bbfabe00d7d2576c30b14257a2e3a6fb5d5c4786cd8e
SSDEEP

3072:+CjqBwkYv4MLAA8k96HM0XU+aDe5UEjmIlmijI7rUGimMpL2HTV+Jbzt8lvRyGt0:+vB5ML3n+aC1meyUGimMpL2z4FmRTqyY

Score

7^/10

adware bootkit persistence stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000014f71-7.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2756	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000014f71-7.dat	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\TypeLib\ = "{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\TypeLib\Version = "1.0"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\TypeLib\ = "{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\ = "FlashPlayer.F_Player"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\TypeLib\ = "{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\0	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\HELPDIR	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ = "_F_Player"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\PlayerComet.dll"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\VERSION\ = "1.0"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.F_Player	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.F_Player\Clsid	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.F_Player\Clsid\ = "{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\TypeLib	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\TypeLib\Version = "1.0"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\InprocServer32\ThreadingModel = "Apartment"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.F_Player\ = "FlashPlayer.F_Player"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\ProgID\ = "FlashPlayer.F_Player"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\VERSION	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\FLAGS\ = "0"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\PlayerComet.dll"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\InprocServer32	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ = "F_Player"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\ = "BitComet - a BitTorrent Client"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\0\win32	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ = "_F_Player"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ProxyStubClsid32	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ProxyStubClsid	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\ProgID	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B467F346-747F-4E48-BA2F-4AFCB5CB3F69}\TypeLib	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4EEF97C5-7B30-4EA9-9F14-9A3D804FD87D}\1.0\FLAGS	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\ProxyStubClsid32	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1514ADE-2E46-4111-8676-8408B1048AA6}\TypeLib	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2756	f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f74d775faf7f38d45139c4d0a660bd83_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\PlayerComet.dll

Filesize
17KB

MD5
c4ba64825b7d69012abd692a637b1d16

SHA1
b5b4165836298983ea1ee498e24665977ea838b1

SHA256
00be2d254419cde832cebe5fbad6e5d0b3a2351328d43de9d23978e18cbe94ba

SHA512
fdb5945333892d287cd347e3dc3f51007db978b5e268c79a67b17c107f93de35c11ef866040ffafd0d7cee439fcb35fdf21d14d303e854c46a29401cd8ce0bb7

Download Submit
memory/2756-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2756-1-0x0000000000860000-0x00000000008CD000-memory.dmp

Filesize
436KB

Download
memory/2756-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2756-4-0x0000000000870000-0x0000000000875000-memory.dmp

Filesize
20KB

Download
memory/2756-10-0x0000000011000000-0x000000001100F000-memory.dmp

Filesize
60KB

Download
memory/2756-11-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads