d11ecfdc1f5d350ff4ff2d1aa08d4e72b0eb424203aee450d39a63c21e489146

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Size

561KB
MD5

0543e7ac313b3445d749bec7aa96325d
SHA1

034ad5993fbfeecac3e1668dcba6a839b7249b86
SHA256

d11ecfdc1f5d350ff4ff2d1aa08d4e72b0eb424203aee450d39a63c21e489146
SHA512

378449930dae4b69bd8b08d68d30e89ff50b71fca404f12fcafcb7a5a2a0f2a81fb31620233c5125d02ba0f9098f830776951d4d02a6ea5161c25c7b39c64ba0
SSDEEP

12288:NxBQrt3Cy7V0h1QWmojX+7oRwm2hRo0sf/bmHr8u8CfiLs08aQNn:N7ct3Cx1mdowmgNsnbmL8u8CfiLs08n

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PricePeepUpdater.lnk	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

InstallUtil.exePricePeepUpdater.exe

pid process

4544 InstallUtil.exe
640 PricePeepUpdater.exe

pid	process
4544	InstallUtil.exe
640	PricePeepUpdater.exe

Loads dropped DLL 13 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

pid	process
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

InstallUtil.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb\2.2.0.10_0\manifest.json	InstallUtil.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Drops file in Program Files directory 5 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\PricePeep\unutil.exe	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\installer.ico	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\pricepeep.dll	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
File created	C:\Program Files (x86)\PricePeep\uninstall.exe	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID\ = "PricePeep.PricePeepBho.1"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\Programmable	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID\ = "PricePeep.PricePeepBho"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\ = "PricePeep 1.0 Type Library"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ThreadingModel = "Apartment"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL\AppID = "{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS\ = "0"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer\ = "PricePeep.PricePeepBho.1"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\ = "PricePeep"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

InstallUtil.exe

pid process

4544 InstallUtil.exe
4544 InstallUtil.exe

pid	process
4544	InstallUtil.exe
4544	InstallUtil.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe

description	pid	process	target process
PID 3016 wrote to memory of 4544	3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 3016 wrote to memory of 4544	3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 3016 wrote to memory of 4544	3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	InstallUtil.exe
PID 3016 wrote to memory of 640	3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 3016 wrote to memory of 640	3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe
PID 3016 wrote to memory of 640	3016	0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe	PricePeepUpdater.exe

C:\Users\Admin\AppData\Local\Temp\0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0543e7ac313b3445d749bec7aa96325d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe" glupgrade
2⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
PID:4544

C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe
"C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe"
2⤵
- Executes dropped EXE
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PricePeep\PricePeepUpdater.exe
Filesize
310KB

MD5
cb477977a329b902f324ec34ef866199

SHA1
e8943e53c46b6baa13dfb97966fea0c3aca61703

SHA256
9affebeda6460dac1591bdda4142c5b5beede0cbb78b60da2641d188893414bc

SHA512
7e44726ca70c52d5abdbd2faff38bfc6582f72a943b83eb1fb8779633d53de14fd00343f94ac569d3a63325c17a0d0eb577c37079ac68a6f4afe50a8cf8b26c4

Download Submit
C:\Program Files (x86)\PricePeep\pricepeep.dll
Filesize
440KB

MD5
b766a1cb57ccf5a3376b06c54f947779

SHA1
99c429ca2d4891fd8aa6646f2e6f88e0314234cf

SHA256
75c6b4c747c3a42bbfecaf39819add2519692d5b54726b0f1de371e58cbf9794

SHA512
9fd46b9d6194505a0111e39ce038169a669b7270f74f776e911da59ca7755e13fa6386875f13d33ce1aaf62ef29997131b21054c3da7871b3848dd2a865fe315

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
209KB

MD5
0a454a58844a365049c68103dc8f4361

SHA1
4980d5db14b3525f359c63670bd3f0370d0e9321

SHA256
18c32b49f76a6dff12047d7ece8f81be3a02ca59248f9b4d73b974ab93c5b2c2

SHA512
d971ed82ee45c5c457b2d7eb4d3f59400c897350411220b5d0673966451918f1847a9c9a4cd037f95076a7a7e4acb388410da9b601c185ea6b688f10927092f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\appprepend.js
Filesize
353B

MD5
9adce7189c584e7ecfb11706e4253c9c

SHA1
cdd12424ffe59378d4f9bbefb1b597d15f8dada3

SHA256
3a850d104cb5ffe402a5dfc6adb39de4ba27a6ff9a8009f00df11e19858d739a

SHA512
2cc641e974d591e2b17eb43cbd41455fb546fac75d78cfe3605dea0d23a9ecef4b4dab7c3bcde096c7392cbc83efb355187c48937fbe32fdc4b696f11db378a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\background.html
Filesize
784B

MD5
ba82642d3a033b95c4d7f324d84ed104

SHA1
ad203efafb9557a1aaa22516861d534ce19f6c4b

SHA256
ecbce9e835208efb2a55549d2b009924940e4c3300933d9f3ad0502f8b9601f2

SHA512
a7f3d802d2ea87ca84dabe45a69dd21230c8f4760970e4c4c8350765488f6e838bcb411239a85196589106d3adbdd167d4bca53d04409d8a5adfc01eac79265f

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\browserevents.js
Filesize
2KB

MD5
f85da6c33a7eb881fce7d9d83fe66038

SHA1
7e66d8a66d8fdfe377889b3eb92e0584580dff93

SHA256
467ec4f74ae1cd09bb49ecc1c469fcd6efef8dc4715ce82e1204c5f38d7d897e

SHA512
d4a7607261f9dc39a932b7bc6ce35fd19255ad1e403838776d092c318cbe712ba34abb38b24ee16471091f69cf04902cb2de2899a1663bb5d114daa790a425da

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\configuration.js
Filesize
7KB

MD5
41d22635c646aea6d3887a62fe059b6c

SHA1
e6709d31e96eb830b8bc1faa0ab1b4f68db954e2

SHA256
c6a75301ec0c5a568a576289b307d3786e9a752788bba10f3bc8d1f55064b08c

SHA512
e7b3dfba8ec8f9b30adcf1e449d2aa7c114f082070d7cc3b7deb2e271805a266b233d5d4d00eae09d80e74f77519faf7e0a1419e9363ffc40c521531b0478a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\consts.js
Filesize
1KB

MD5
96903b256e7fa960e394eb79a9b1ee10

SHA1
dc718012a19faa823a3d258cb0d8196eca522eb1

SHA256
2cf2d8968e9e3b831f4b98af59f8f1518e3bf218729787e765253d94c29b6fb5

SHA512
0e41e356206d5a0ffc77560da126ca6cb91c82c6f732e719ec4732cd37f5e78f8f7a2171353c5b7b3f27cc1f7521cd3f80c993b9a17e0d7f022a7dfffccd7c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\diagnostics.js
Filesize
2KB

MD5
5b150150a0c64ccdea519088008edbef

SHA1
51edddce6cb42e487a8e46d24f462d5af3f74757

SHA256
38cf707eaf5853817e503bd4183c45ded0371fb4f72d59d4161130c2b97d2279

SHA512
b76c396edf5f43190050c453d9ee8cdf555ff4fe6f541f08af2c20fc7eec04b28cadd552c00f687ca5633708a8be83df90ab970a457c808dde0d40c72cc00047

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\format.js
Filesize
999B

MD5
ce55f10e86c34b20fc340cc02b2edabc

SHA1
58373e51d8c7c05a1c7e9753502b0d73920d6515

SHA256
615388bee1427d458bcdd292c33510c3cd882e4cb29f4b6d695d2941728a3803

SHA512
bc026a4152087ac4b7351c2d569e77352130872946b9bf73746860d5e9eba2174b821044a7cb0b6b060e01f7876b9752e43ed9432fcf51abeb5779cb98f5068c

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\framenotifier.js
Filesize
514B

MD5
049dbb34e15630db1fe2bbcee192534d

SHA1
7350ea64aa66eb36e976f08d2a225eeafd0a7215

SHA256
c03ba3d5590ad49784bd4ee141239026005a5c24b5dc38aa1c384323abadaf81

SHA512
51a6e96f69819c1ed414b1116a795c640d909efd498eed0f3e75ec8e8f3da34a56a7108f8ba75c40e87b1c32081c655a1890d7fd54fcf68050df69ab2ed62234

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\jigsawapi.js
Filesize
6KB

MD5
d7ea15ed1f223115f7927837fb976b76

SHA1
071996e9effa54eba0753c50ff99a722113878e6

SHA256
9e76c56a515520da063842af0b94adae9cfb2751d02aab829e4a1fcab2ebc633

SHA512
db1f0c1d37fed544bbd2897998c1938d0e255d649aa9a1b9673ca49889bedad64a6e29dd0648dd32d8f66792d8c635bc6d7341a172d38cc562903ada8623c331

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\jquery-1.4.4.min.js
Filesize
76KB

MD5
b76fc63a9c3fc4293fb90990818dd100

SHA1
7d591c32b44e66c2b1aadec2dd0d1e2f88a5bb3a

SHA256
48d685402b465594e6ec567be7f1cddcedadc9b6721f5eed1ffe7555c15ef0dc

SHA512
8694c0da19bb9586b3a9ea8a791978a3dba3f4edc397a058fde91ff1a863432b039ead2e3b3758c10581da93ad1ced52a334de57b38a6e7e935ad9798075f473

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\main.js
Filesize
7KB

MD5
312de7c7826caf82945c3f91d62c92ef

SHA1
f685c85044e4db07475c5e285c1603c778cb60ef

SHA256
0523b12a5b48882f9f8db78a9424c0051f97c7f894cf7d644fd537a70dcd2870

SHA512
ab5498fea2b636740eade907ae3c2fa1dcb071c3867d39eefeddc406dbd3c3fd7d9f43b8db4a86f47c9fff390d57c9f4db9c91b24132326c064ae9bdbbf7535e

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\manifest.json
Filesize
812B

MD5
ff1efae581cefc3709a18d43422e5cdb

SHA1
dbc426c1ff8116dd0ba598324ff3a4cb00ac7694

SHA256
a8d0b3a68ce51c466ece2d2005f5c27ddd7e555561b27200c3de3985d38b5aa3

SHA512
d8b7ed9d789f2d3d36a2ddfbdaab30b7a34563d36f686343b7f242861caf342ebbf918aab4f1a2fd60ccbd453734ded6ca65e74ff2cce64f10ab6463865cfa3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\request.js
Filesize
13KB

MD5
b255f3b5dcae35adfd22470c900b1ed1

SHA1
672e0f39c50fb16e44e472419eb5d45f1738c7a0

SHA256
8eac32e954b24f01ea6bc453cd20adeeeb15f90fa6ef5a0db0e74b87dc63c85c

SHA512
f4c59e57d787146927e51ba07f3d5b3111c18f222271c4d571977f6548c35a3931e4aad859505a44f39ad4d52f651f1f177d0c561dd028c3ad3cd45b4affbde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\script.js
Filesize
12KB

MD5
56d6290648e6bc869fa789a1c1ac5196

SHA1
20e8c81d1d919818c9a3587d49b6d226c40f2771

SHA256
de1d539654e696f596c5041673091f8e7f8624f167127b6ecc4786d1d9689757

SHA512
0fb5c98521e7f47789d291b0b1f19d30af992c2371c95cbf7ed71d7c55f73cbbfae44ff12e5a8fbddb612cf00e5c2ccf707453ef81019b90bd714c37278cde1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\stats.js
Filesize
2KB

MD5
9c2d9e5dd7ef81f2bce502cb5cec2d01

SHA1
5d94c87492c1c6ece424889e9d9a2517308b57e0

SHA256
3a2a5f3ab3fe970e54588cd579e0ba1d520d8b8e367f2f8b8c8097996b86dba0

SHA512
b3a7b204d7aef12e62d96e8a4069d33786247851565603f0101a183554121fa8e5821bed144fc717e5f8cf1050ea08cc665f8ab3d1eec348168e3e0a31a42f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\glupgrade\storage.js
Filesize
1KB

MD5
5dff8d319bd03393658d1b752b3f7d3c

SHA1
ba0be00d0d653e165c3254959e1c2f5a453984f5

SHA256
c1fe3685967b44b35d6846a2b4815ecea5d5e25b11397bc9095cf4e933bc9b7b

SHA512
6650ff4bceb15ec2ce8dd72af3e6c92d06eb51d25a0f113aa5afb3be25ec5c3e10e2b1062769fb1bebf5314f344abc8fe9108b5c9e7313b000f880dafd61766f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso36B2.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso36B2.tmp\UAC.dll
Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso36B2.tmp\inetc.dll
Filesize
20KB

MD5
4c01fdfd2b57b32046b3b3635a4f4df8

SHA1
e0af8e418cbe2b2783b5de93279a3b5dcb73490e

SHA256
b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014

SHA512
cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2

Download Submit
memory/640-97-0x00000000014A0000-0x00000000014A1000-memory.dmp

Filesize
4KB

Download