Overview
overview
7Static
static
32709caed68...18.exe
windows7-x64
72709caed68...18.exe
windows10-2004-x64
7$PLUGINSDI...eI.dll
windows7-x64
3$PLUGINSDI...eI.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gr.dll
windows7-x64
3$PLUGINSDI...gr.dll
windows10-2004-x64
3$R0.dll
windows7-x64
6$R0.dll
windows10-2004-x64
6$R2/NSIS.L...5_.exe
windows7-x64
1$R2/NSIS.L...5_.exe
windows10-2004-x64
1updater.exe
windows7-x64
7updater.exe
windows10-2004-x64
7Analysis
- max time kernel
136s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/05/2024, 22:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2709caed68029067c28fea7c135978d2_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2709caed68029067c28fea7c135978d2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ChromeI.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ChromeI.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserMgr.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserMgr.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$R0.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$R0.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$R2/NSIS.Library.RegTool.v3.$_15_.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
$R2/NSIS.Library.RegTool.v3.$_15_.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
updater.exe
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
General
- Target 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe
- Size 997KB
- Sample240508-2gvy4sde48
- SHA256 072f4a30adc96c3271ed2f7ef98892efb0ca899d1f5bbc86af6b25191e562a36
- MD5 2709caed68029067c28fea7c135978d2
- SHA1 f864a2027f26335c2e4d9e7d6d3656d282c0fb3b
- SHA512 b968d94ccc6f05cb82ccbafa2e8b04fa68f33f20b0dc5eb172b399bc459794953020259b0d91e68587bc361abb8daf0d341f91ed44a710ec2aab815c58d4f4e0
- SSDEEP 24576:ZW8abOYrPS+9nXk/AAGQuBZlyDOF2eZdhuvPEBjZzq:03bOUN9nX7lyDOpZdhuvAdq
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023460-58.dat acprotect - Loads dropped DLL 16 IoCs
pid Process 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 2536 regsvr32.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32\ = "C:\\Program Files (x86)\\Dealbeaver\\Dealbeaver64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
resource yara_rule behavioral2/files/0x0007000000023460-58.dat upx behavioral2/memory/532-83-0x0000000074C10000-0x0000000074C1A000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updater = "C:\\Program Files (x86)\\Dealbeaver\\updater.exe" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe - Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhldmkghjkldhclddpjebfjpaijaajmm\1.0.6_0\manifest.json 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe - Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\ = "Dealbeaver helper object" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\NoExplorer = "1" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\ = "Dealbeaver helper object" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768} 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Dealbeaver\updater.exe 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Dealbeaver\Dealbeaver.dll 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe File created C:\Program Files (x86)\Dealbeaver\Dealbeaver.dll 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Dealbeaver\Dealbeaver64.dll 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe File created C:\Program Files (x86)\Dealbeaver\Dealbeaver64.dll 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32\ThreadingModel = "Apartment" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Implemented Categories 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\0\win32\ = "C:\\Program Files (x86)\\Dealbeaver\\Dealbeaver.dll" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723} 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\ = "DealbeaverBHO Class" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768} 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\ = "Dealbeaver 1.0 Type Library" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\TypeLib\Version = "1.0" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\ = "DealbeaverBHO Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{B32F6B5F-0B6A-46ED-9BB0-C2CC8A2B6CD9}\ = "Dealbeaver" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO.1\ = "DealbeaverBHO Class" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\TypeLib 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\VersionIndependentProgID\ = "Dealbeaver.DealbeaverBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO.1\CLSID 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\ = "IDealbeaverBHO" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\TypeLib 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\VersionIndependentProgID\ = "Dealbeaver.DealbeaverBHO" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\0\win32 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Dealbeaver.dll 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\ProgID\ = "Dealbeaver.DealbeaverBHO.1" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D} 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723} 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{B32F6B5F-0B6A-46ED-9BB0-C2CC8A2B6CD9}\ = "Dealbeaver" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\CLSID\ = "{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\HELPDIR 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\TypeLib\ = "{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\TypeLib\Version = "1.0" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Dealbeaver.dll\AppID = "{B32F6B5F-0B6A-46ED-9BB0-C2CC8A2B6CD9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\ = "DealbeaverBHO Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO.1\CLSID\ = "{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32\ = "C:\\Program Files (x86)\\Dealbeaver\\Dealbeaver.dll" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\ = "IDealbeaverBHO" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\CurVer\ = "Dealbeaver.DealbeaverBHO.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\VersionIndependentProgID 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\TypeLib 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Implemented Categories\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO.1 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\ = "DealbeaverBHO Class" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\TypeLib\ = "{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\ProxyStubClsid32 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F55A0A-DD8C-4ACE-B05F-1F9223A02723}\ProxyStubClsid32 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\CLSID\ = "{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\0\win64\ = "C:\\Program Files (x86)\\Dealbeaver\\Dealbeaver64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\CurVer\ = "Dealbeaver.DealbeaverBHO.1" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO\CLSID 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Implemented Categories\ 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\FLAGS\ = "0" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO.1\ = "DealbeaverBHO Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dealbeaver.DealbeaverBHO 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\Programmable 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DB7332F-AD84-4C06-A6D5-5FBB63243A6D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Dealbeaver" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5C87FD0-85EF-45B6-AF57-BE74A5FF1768}\InprocServer32\ = "C:\\Program Files (x86)\\Dealbeaver\\Dealbeaver64.dll" regsvr32.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 532 wrote to memory of 2536 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 83 PID 532 wrote to memory of 2536 532 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe 83 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\DisableAddonLoadTimePerformanceNotifications = "1" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\IgnoreFrameApprovalCheck = "1" 2709caed68029067c28fea7c135978d2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2709caed68029067c28fea7c135978d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2709caed68029067c28fea7c135978d2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:532 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Dealbeaver\Dealbeaver64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Dealbeaver\Dealbeaver.dll
- Size 346KB
- SHA256 4902b2a99a4c53045c21dd542d2e60352da5f1b2b95e04ec85348201708334c2
- MD5 8238d42c6e0a538e15bb4565ec969acf
- SHA1 8561af6b5dd6601be97ea0256c78699d274fe19d
- SHA512 03ae59bf8d83beef8ada6af7776b9a9be5a9a77d120fc0e67d1e76e0c2e507b5bb7aab9d9ab6ae8fa081b893abad78b53f6831e5bab7ca8bf3b28fb4cad20ac9
- SSDEEP 6144:ko4GvXJhRFVwG7LrM2E91xI4wyiySoezOw+3X/1ve/pqnoo:3vfJHfwkPMzrxIYiySXywq/dvnoo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Dealbeaver\Dealbeaver64.dll
- Size 425KB
- SHA256 44e0b553b845628e900f98f0b4bd3374f590c89f7dc26946ddedeff10c44bdf8
- MD5 0753667e464b61803ad6d004f8a259a7
- SHA1 97c0f9ed0523e6b8807d751ec5ce72a3152ee1bc
- SHA512 b2bd9eb2a62ff6b64cafc0c72703f79d7de75c19828b852dff809a9afdd6f8448b043037b0f07be856ad563a9a1b99b46005ee28255c2d79d1d5653b7bbd4227
- SSDEEP 6144:I76JpDM41/8WupuwlQkaxAdFa2sZQrgO89i+nTWF40EXBBwn/CHC9+scMELq5bVU:IyIvWg/dFT44Ks+TDqXt5bVz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa39FD.tmp\ChromeI.dll
- Size 617KB
- SHA256 1ab36e4990c1f57816e22bfdbf31c6b60d63d1d11760b8534a0e543493e69fc2
- MD5 b5fb2749c737cffcdbe599b269adddf5
- SHA1 6932ecc9baee317cb51340ac1a2f835bfada1d41
- SHA512 e9f6dda2c9a3a6c3ee02115ba3275e0db292bca9b7b966ec80040b1d257134e817a3bd7581f003c736109b198fdd1ab77b930356f21f6405fd5c1fad1b65c000
- SSDEEP 12288:nXyN7tRveGLwzMUdN/j2oE0ZBiFhjx2DZdw5Mfp:nXyNJRveGL0MUTrkjFhjx2DqMfp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa39FD.tmp\System.dll
- Size 10KB
- SHA256 4ca5bf1beb4b802914c4d3e2f37861f6ba5ecf969cfeadf5855edf58f647a721
- MD5 0ff5120f1afd0f295c2baa0f7192d3f8
- SHA1 bde842d5d11005dcb4ff1d4ea97da31865477697
- SHA512 e049ffd7aace8d136eee007ee4f8dbc2ae8f3dce79d1c633d9654392240f8215787df8a6d08085257db51f28ff2a8023a13333dda3ea7f9bdc8b9c57b605f0a0
- SSDEEP 192:Xv+cJZE61KRWJQO6tFiUdK7ckD4k7l1XRBm0w+NiHi1nSJ:Xf6rtFRdbQ1W+fn8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa39FD.tmp\UserMgr.dll
- Size 55KB
- SHA256 54a9ab4ac127d950ad293a71f5a496af3ab09b70aa73839fd0f1c9cbaf35f70e
- MD5 74813d238f84d5c0f5328bd7ba79537a
- SHA1 5aeecd94f0902bad1572fd2cceada9ad44af6725
- SHA512 ac7fb85c6375bc3e0e76b535550b604cbad31e69696030314f34e41d3bb5c04411ec826c89885c30556649961d45061f501db6a37a23bb419e4f1e7cea34deff
- SSDEEP 768:WThBSJtwQegACHpCygw5eKeK/B/viiTRvTkujLWf2UEHzDSZA7yM5jt/BJE4lW:aSCQeLCHpCyNV9ZTRbkuOQzyMVt/blW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa39FD.tmp\nsJSON.dll
- Size 7KB
- SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
- MD5 b9cd1b0fd3af89892348e5cc3108dce7
- SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
- SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
- SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa39FD.tmp\nsProcess.dll
- Size 4KB
- SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
- MD5 faa7f034b38e729a983965c04cc70fc1
- SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
- SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
- SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
- MD5 SHA1 SHA512 SSDEEP