8f824e3d5ddd51de7fa0ed2753561d5e55756c3afc9420323dcf38d08a5ce87e

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
Size 128KB
Sample240611-ybfepayepb
SHA256 8f824e3d5ddd51de7fa0ed2753561d5e55756c3afc9420323dcf38d08a5ce87e
MD5 9f51367bdd6c059dcefaf810dc7f66e1
SHA1 26c0cafc0472d02fceb6b668868e40d63ac9e08b
SHA512 ba780130915ec5aff69c8f321552c7c1ae5660d480d701c30550eb2337b0a9da5e1b0771de2a0cada010df769fbde8356db2087dad00ad283d61fa09fa5b55a0
SSDEEP 3072:/HJea27VDfnon4nnnnYdQlwxIlnjwtbKipXev8ZlIgqAnjOsUsGo+oRMsFnnnnn2:/p/2CdLxOoKbkZlIgVJGh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00090000000233e2-2.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
1784	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
1784	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00090000000233e2-2.dat	upx
behavioral2/memory/1784-8-0x00000000001C0000-0x00000000001FC000-memory.dmp	upx
behavioral2/memory/1784-6-0x00000000001C0000-0x00000000001FC000-memory.dmp	upx
behavioral2/memory/1784-9-0x00000000001C0000-0x00000000001FC000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F44928C-1DFF-46B8-9E7E-52EF743388A1}	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F44928C-1DFF-46B8-9E7E-52EF743388A1}\InprocServer32	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F44928C-1DFF-46B8-9E7E-52EF743388A1}	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F44928C-1DFF-46B8-9E7E-52EF743388A1}\InprocServer32\ = "C:\\Windows\\SysWow64\\apprepap.dll"	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F44928C-1DFF-46B8-9E7E-52EF743388A1}\InprocServer32\ThreadingModel = "apartment"	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1784	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
1784	9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f51367bdd6c059dcefaf810dc7f66e1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprepap.dll

Path C:\Windows\SysWOW64\apprepap.dll
Size 86KB
SHA256 734b2eaa834f5d114424ebe6842609b6dbef5dc4b61634a824c2a76d14e4ba86
MD5 32184376259804c2b3160cdd5cf4d8c7
SHA1 9ef738f1b32169fbd31fe3d1ad47fad096449507
SHA512 026655e042e0653a2fbaf894eb4bf3a921b64ab2d30ef5c5adb7666d52cbef04e7d8556297231072aa65645db645ca01b0da97f0ce525eadc8dfdc905248355c
SSDEEP 1536:SYvynn+A2VveCGkTMNF3g5yDK6J6FMFdddHRq8nLWU4xoKty:vv4+Ad8W3WGSsphAOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1784-8-0x00000000001C0000-0x00000000001FC000-memory.dmp

Download

memory/1784-6-0x00000000001C0000-0x00000000001FC000-memory.dmp

Download

memory/1784-9-0x00000000001C0000-0x00000000001FC000-memory.dmp

Download