Overview

overview

7

Static

static

3

a5017649be...18.exe

windows7-x64

7

a5017649be...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 10:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a5017649be5636baf60408163c11100b_JaffaCakes118.exe
  • Size 1.5MB
  • Sample240613-l58bcayapp
  • SHA256 21914e0e745bf2246f62345d04e986edefcebe5a8842f661a4386d3fc9974f95
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5017649be5636baf60408163c11100b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a5017649be5636baf60408163c11100b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\5d502904\qs8iw.exe
      "C:\Users\Admin\AppData\Local\Temp/5d502904/qs8iw.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2996
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\NexuttCooup\HF9F.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\NexuttCooup\HF9F.x64.dll"
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Installs/modifies Browser Helper Object
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:2620
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:8
    1⤵
      PID:4820

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          HF9F.dll
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\HF9F.dll
          • Size 414KB
          • SHA256 2ec40c7a7808d8aeee27eb8db1ed36424dd7d692e6d2043b20b3c75e8dd2b4d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          HF9F.tlb
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\HF9F.tlb
          • Size 3KB
          • SHA256 af8efa41494e63e07553fed5bd5df73cf55c160de292ea2a2ee0568cf12e0156
          • MD5 SHA1 SHA512
          Submit Download

          HF9F.x64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\HF9F.x64.dll
          • Size 461KB
          • SHA256 fde9e3251cc1237aa3b2ad89acfb5691e8fee5a434989d9a9308ab41b774b672
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          JOaCHZ.js
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\pgfhggfhbebbeillggnpmnimkfncblim\JOaCHZ.js
          • Size 25KB
          • SHA256 893c982738117ea700cccae7ad51cc0438f694b9e4294043f76ea39ca96e2a10
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          background.html
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\pgfhggfhbebbeillggnpmnimkfncblim\background.html
          • Size 143B
          • SHA256 d1c68fa3cfe722f81e3860b37cb91c90790549bfd15ab2ab8e3fdce4851cedc7
          • MD5 SHA1 SHA512
          Submit Download

          content.js
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\pgfhggfhbebbeillggnpmnimkfncblim\content.js
          • Size 8KB
          • SHA256 3d7d4cfbbb7cc7500789e18de1682ec33e7d9642588a7e2f51b6103c7ec06c13
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lsdb.js
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\pgfhggfhbebbeillggnpmnimkfncblim\lsdb.js
          • Size 8KB
          • SHA256 9c93419805de7973916a8786bd606f826da08e8ec55af37890c1e331b299df4c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\pgfhggfhbebbeillggnpmnimkfncblim\manifest.json
          • Size 503B
          • SHA256 320b9444d6e19b86811469436a555eb6aafe585e0ea8e0db47a89ac785d9ee0a
          • MD5 SHA1 SHA512
          Submit Download

          qs8iw.dat
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\qs8iw.dat
          • Size 4KB
          • SHA256 57870d37ebb6cdeba4b938a654461f43c71d006e8657f501fde1834600160f9b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          qs8iw.exe
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\qs8iw.exe
          • Size 450KB
          • SHA256 90c89493534236e9a525040b3fcd1acbcb737314a5b76ec2674eacdedeb29a02
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bootstrap.js
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\[email protected]\bootstrap.js
          • Size 2KB
          • SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
          • MD5 SHA1 SHA512
          Submit Download

          chrome.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\[email protected]\chrome.manifest
          • Size 25B
          • SHA256 e0fd13d4b30029a2625dc9c9eaff3e8f4c4bb79ca09887cc26c82b616d718c98
          • MD5 SHA1 SHA512
          Submit Download

          bg.js
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\[email protected]\content\bg.js
          • Size 26KB
          • SHA256 0ac014e40892bb074786fd5dfc3f5a1408ee41debb41f0588c8459c2ad291592
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Local\Temp\5d502904\[email protected]\install.rdf
          • Size 599B
          • SHA256 b02006fa98375b8648c72220b361ce3ceb001a86a6a4fef830a00bb39109a521
          • MD5 SHA1 SHA512
          Submit Download