6b96bec6e82e9a07a52e8021d14c722888cb58a05d3fe0ab874d5a39faaee7dc

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
Size 404KB
Sample240530-hvgtvsbb68
SHA256 6b96bec6e82e9a07a52e8021d14c722888cb58a05d3fe0ab874d5a39faaee7dc
MD5 835e8a170da6200aad58753bf4235ba2
SHA1 acad8d82709b11aa074f2e3eecb64360f5dc18ba
SHA512 029f336f9a7a55e39aa1cbebe3dc66ea046921d4dca278ba69c6da4aa6a1f7762d79a1033bcf1917401a02692bcee9a5d5be54d373666035f19b22eb11c6b34b
SSDEEP 6144:pX25qO2Z9emLkJxKjBIm5bGJcQkZa1HkDhbO4ijNRsicNHYEOzQoNbnCIYY9dO1o:pm5qJH3AJxIIKaJcQr1HgU9RoRwZ9m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware evasion stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00090000000233ff-13.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4784	REGSVR32.EXE
4948	REGSVR32.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00090000000233ff-13.dat	upx
behavioral2/memory/4784-15-0x0000000011000000-0x0000000011043000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{079DDE04-D793-4D3F-B183-45670F4CCBCE}	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{079DDE04-D793-4D3F-B183-45670F4CCBCE}\	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IExplorer.txt	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
File opened for modification	C:\Windows\CGZipLibrary.dll	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
File opened for modification	C:\Windows\Unzip32.dll	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
File opened for modification	C:\Windows\libmySQL.dll	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{079DDE04-D793-4D3F-B183-45670F4CCBCE}\ProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\TypeLib\Version = "3.0"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ProxyStubClsid	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\ProgID	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\Implemented Categories	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\ = "CGUnzipFiles"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A326820C-B688-47B0-8AF6-4144835EE527}\1.0\0	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{079DDE04-D793-4D3F-B183-45670F4CCBCE}\InprocServer32\ = "C:\\Windows\\IExplorer.txt"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\ProxyStubClsid	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{293364AC-43F8-11D3-BC2D-4000000A2806}\3.0\FLAGS\ = "0"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\TypeLib\ = "{293364AC-43F8-11D3-BC2D-4000000A2806}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\InprocServer32\ThreadingModel = "Apartment"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ProxyStubClsid32	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\ProgID\ = "CGZipLibrary.CGZipFiles"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\VERSION	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CGZipLibrary.CGUnzipFiles\Clsid	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{293364AC-43F8-11D3-BC2D-4000000A2806}\3.0\0\win32\ = "C:\\Windows\\CGZipLibrary.dll"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{293364AC-43F8-11D3-BC2D-4000000A2806}\3.0\HELPDIR\ = "C:\\Windows"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\ = "CGZipLibrary.CGUnzipFiles"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\ = "_CGUnzipFiles"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ = "_CGZipFiles"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGZipLibrary.CGZipFiles\Clsid\ = "{293364BA-43F8-11D3-BC2D-4000000A2806}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\Programmable	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\ = "_clsSFlashVideo"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\ProxyStubClsid32	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ = "_CGZipFiles"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGZipLibrary.CGUnzipFiles\Clsid\ = "{293364AE-43F8-11D3-BC2D-4000000A2806}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{079DDE04-D793-4D3F-B183-45670F4CCBCE}\Implemented Categories	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{293364AC-43F8-11D3-BC2D-4000000A2806}	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{293364AC-43F8-11D3-BC2D-4000000A2806}\3.0\FLAGS	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\TypeLib	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\TypeLib\Version = "3.0"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A326820C-B688-47B0-8AF6-4144835EE527}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}\TypeLib\ = "{A326820C-B688-47B0-8AF6-4144835EE527}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{293364AC-43F8-11D3-BC2D-4000000A2806}\3.0\0	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\ProgID	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\ProgID\ = "CGZipLibrary.CGUnzipFiles"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\TypeLib\ = "{293364AC-43F8-11D3-BC2D-4000000A2806}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\ = "_CGUnzipFiles"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\TypeLib\ = "{293364AC-43F8-11D3-BC2D-4000000A2806}"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{079DDE04-D793-4D3F-B183-45670F4CCBCE}\TypeLib	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SFlashVideo.clsSFlashVideo\ = "SFlashVideo.clsSFlashVideo"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SFlashVideo.clsSFlashVideo\Clsid\ = "{079DDE04-D793-4D3F-B183-45670F4CCBCE}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\TypeLib\ = "{293364AC-43F8-11D3-BC2D-4000000A2806}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A94EB03B-C212-4EAF-8B68-3CF09F0B2C29}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGZipLibrary.CGZipFiles\ = "CGZipLibrary.CGZipFiles"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\InprocServer32	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\Implemented Categories	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\InprocServer32\ = "C:\\Windows\\CGZipLibrary.dll"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1922089-CC7D-47A2-A1F5-D48BC110ED38}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364BA-43F8-11D3-BC2D-4000000A2806}\TypeLib	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{293364AE-43F8-11D3-BC2D-4000000A2806}\VERSION	REGSVR32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A326820C-B688-47B0-8AF6-4144835EE527}\1.0\FLAGS\ = "0"	REGSVR32.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A91696D-9B1F-441E-89E8-8AF399B9B1B0}	REGSVR32.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4784	2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe	85
PID 2884 wrote to memory of 4784	2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe	85
PID 2884 wrote to memory of 4784	2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe	85
PID 2884 wrote to memory of 4948	2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe	86
PID 2884 wrote to memory of 4948	2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe	86
PID 2884 wrote to memory of 4948	2884	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe	86

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\835e8a170da6200aad58753bf4235ba2_JaffaCakes118.exe"
1⤵
- UAC bypass
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2884
- C:\Windows\SysWOW64\REGSVR32.EXE
  C:\Windows\system32\REGSVR32.EXE /s C:\Windows\IExplorer.txt
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4784
- C:\Windows\SysWOW64\REGSVR32.EXE
  C:\Windows\system32\REGSVR32.EXE /s C:\Windows\CGZipLibrary.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CGZipLibrary.dll

Path C:\Windows\CGZipLibrary.dll
Size 56KB
SHA256 7f3deb2aacfc9ff34db594933f4a0e8a938cfb2c53819f15b6a5834395b90c05
MD5 aae92a44011531c9c8e04a876d2bd64c
SHA1 58162685746c174f85746a5b35134223244eb8e9
SHA512 6e1dfdd441c27130684e165201b6bf939bdc9393a2e12fe29de7f21030e5bf9236947196dcae42bde4e7defa61189bbc9cf39d4567aa466fba777c955dfc3024
SSDEEP 768:l9FGG0ecuQWFteBLLU934T3cbLTPHA5HyTxy0sGtuKmvkE:l9FKeQpI4TsNy0sxk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.txt

Path C:\Windows\IExplorer.txt
Size 65KB
SHA256 3c7c5c66804286a41440feb1efd9b9ca68be507b3b6e80eaddbfb52a2433705d
MD5 ba8ea5e2c0f4a87e83229386148493c6
SHA1 1b69a2a8c5b5f33c72db07b55ea6272b49815eb7
SHA512 37a89c7715eac227ad3161178b37bd31dad128d3a4a931c48e97cf70ea31d6432060f3d809a0ac97b32d7554cd9427988c7663b552e964df4d66eb47350fe7a7
SSDEEP 1536:GVZLozCgCUYw5NEw1F0GrzAVbc8IQDQdC:GVCT8uFfzf/8IC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2884-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4784-15-0x0000000011000000-0x0000000011043000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads