d11ecfdc1f5d350ff4ff2d1aa08d4e72b0eb424203aee450d39a63c21e489146

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Size

561KB
MD5

0543e7ac313b3445d749bec7aa96325d
SHA1

034ad5993fbfeecac3e1668dcba6a839b7249b86
SHA256

d11ecfdc1f5d350ff4ff2d1aa08d4e72b0eb424203aee450d39a63c21e489146
SHA512

378449930dae4b69bd8b08d68d30e89ff50b71fca404f12fcafcb7a5a2a0f2a81fb31620233c5125d02ba0f9098f830776951d4d02a6ea5161c25c7b39c64ba0
SSDEEP

12288:NxBQrt3Cy7V0h1QWmojX+7oRwm2hRo0sf/bmHr8u8CfiLs08aQNn:N7ct3Cx1mdowmgNsnbmL8u8CfiLs08n

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PricePeepUpdater.lnk	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

InstallUtil.exePricePeepUpdater.exe

pid process

2576 InstallUtil.exe
2800 PricePeepUpdater.exe

pid	process
2576	InstallUtil.exe
2800	PricePeepUpdater.exe

Loads dropped DLL 11 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

pid	process
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Drops file in Program Files directory 5 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\PricePeep\installer.ico	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\pricepeep.dll	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\uninstall.exe	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\unutil.exe	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS\ = "0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL\AppID = "{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\ = "PricePeep 1.0 Type Library"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID\ = "PricePeep.PricePeepBho.1"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID\ = "PricePeep.PricePeepBho"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer\ = "PricePeep.PricePeepBho.1"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\Programmable	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ThreadingModel = "Apartment"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InstallUtil.exe

pid process

2576 InstallUtil.exe

pid	process
2576	InstallUtil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	pid	process	target process
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2576	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 2388 wrote to memory of 2800	2388	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe

C:\Users\Admin\AppData\Local\Temp\0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe" glupgrade
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe
  "C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe"
  2⤵
  - Executes dropped EXE
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\glupgrade\consts.js

Filesize
1KB

MD5
96903b256e7fa960e394eb79a9b1ee10

SHA1
dc718012a19faa823a3d258cb0d8196eca522eb1

SHA256
2cf2d8968e9e3b831f4b98af59f8f1518e3bf218729787e765253d94c29b6fb5

SHA512
0e41e356206d5a0ffc77560da126ca6cb91c82c6f732e719ec4732cd37f5e78f8f7a2171353c5b7b3f27cc1f7521cd3f80c993b9a17e0d7f022a7dfffccd7c16

Download Submit
\Program Files (x86)\PricePeep\PricePeepUpdater.exe

Filesize
310KB

MD5
cb477977a329b902f324ec34ef866199

SHA1
e8943e53c46b6baa13dfb97966fea0c3aca61703

SHA256
9affebeda6460dac1591bdda4142c5b5beede0cbb78b60da2641d188893414bc

SHA512
7e44726ca70c52d5abdbd2faff38bfc6582f72a943b83eb1fb8779633d53de14fd00343f94ac569d3a63325c17a0d0eb577c37079ac68a6f4afe50a8cf8b26c4

Download Submit
\Program Files (x86)\PricePeep\pricepeep.dll

Filesize
440KB

MD5
b766a1cb57ccf5a3376b06c54f947779

SHA1
99c429ca2d4891fd8aa6646f2e6f88e0314234cf

SHA256
75c6b4c747c3a42bbfecaf39819add2519692d5b54726b0f1de371e58cbf9794

SHA512
9fd46b9d6194505a0111e39ce038169a669b7270f74f776e911da59ca7755e13fa6386875f13d33ce1aaf62ef29997131b21054c3da7871b3848dd2a865fe315

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Filesize
209KB

MD5
0a454a58844a365049c68103dc8f4361

SHA1
4980d5db14b3525f359c63670bd3f0370d0e9321

SHA256
18c32b49f76a6dff12047d7ece8f81be3a02ca59248f9b4d73b974ab93c5b2c2

SHA512
d971ed82ee45c5c457b2d7eb4d3f59400c897350411220b5d0673966451918f1847a9c9a4cd037f95076a7a7e4acb388410da9b601c185ea6b688f10927092f3

Download Submit
\Users\Admin\AppData\Local\Temp\nstD1D.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstD1D.tmp\UAC.dll

Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nstD1D.tmp\inetc.dll

Filesize
20KB

MD5
4c01fdfd2b57b32046b3b3635a4f4df8

SHA1
e0af8e418cbe2b2783b5de93279a3b5dcb73490e

SHA256
b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014

SHA512
cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2

Download Submit
memory/2800-96-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download