Overview

overview

7

Static

static

3

01f6baa516...18.exe

windows7-x64

7

01f6baa516...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    55s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/04/2024, 00:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe
  • Size 2.3MB
  • Sample240427-acrmcaeg74
  • SHA256 51d35d521169eaef5e7d4f0770d604306e53cff50eb52b7c9efb4b3b19e36c6c
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoverypersistencestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\01f6baa5167877bcaa01bf1de89c130e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\51f92808\mpbUarwSj8DqSUE.exe
      "C:\Users\Admin\AppData\Local\Temp/51f92808/mpbUarwSj8DqSUE.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2632
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4136
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\VaaiuDiX\zfAxFMgyBZ6ls4.x64.dll"
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Installs/modifies Browser Helper Object
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:3744

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        mpbUarwSj8DqSUE.dat
        • Path C:\Users\Admin\AppData\Local\Temp\51f92808\mpbUarwSj8DqSUE.dat
        • Size 7KB
        • SHA256 09693f2b2b9e8387b368ff5cc310c1505ed85c5617ec4bff1520f9c15d904e4e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mpbUarwSj8DqSUE.exe
        • Path C:\Users\Admin\AppData\Local\Temp\51f92808\mpbUarwSj8DqSUE.exe
        • Size 766KB
        • SHA256 1d94c27748e7d0dc5ffd03ae99acd9c30aaa8a6e91a66beab420650f9d6e4977
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zfAxFMgyBZ6ls4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\51f92808\zfAxFMgyBZ6ls4.dll
        • Size 573KB
        • SHA256 d8c8085e002578d7dad3d16100a7a4984b13b923c36459ddb83d71bf811ac3de
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zfAxFMgyBZ6ls4.tlb
        • Path C:\Users\Admin\AppData\Local\Temp\51f92808\zfAxFMgyBZ6ls4.tlb
        • Size 4KB
        • SHA256 ee29d7672ab20bd7c779268d59994217be7d3704396e52785f3da70db8afb02b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zfAxFMgyBZ6ls4.x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\51f92808\zfAxFMgyBZ6ls4.x64.dll
        • Size 645KB
        • SHA256 128a355220799bbea2587e47eeb23f47b711a7adba937858871f5f7c888b3466
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {77c527ad-3b25-49e0-9a61-f4d64e6de96a}-log.txt
        • Path C:\Users\Admin\AppData\Local\Temp\{77c527ad-3b25-49e0-9a61-f4d64e6de96a}-log.txt
        • Size 652B
        • SHA256 d64fe8315bfe2bf92a79244f0077cf26ca8fafd1ac3b9686ad48485710fbaf38
        • MD5 SHA1 SHA512
        Submit Download