232d1cf17d24a97d62b1226443bb81af635f8c042222b52a436d1efe5d398fb4

Analysis

max time kernel
51s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa27642d1c4df01e6e49959277503c87_JaffaCakes118.exe
Size 2.0MB
Sample240614-rppf7athlc
SHA256 232d1cf17d24a97d62b1226443bb81af635f8c042222b52a436d1efe5d398fb4
MD5 aa27642d1c4df01e6e49959277503c87
SHA1 1d79c105de469d9c956aaa490934a5b05a0829a1
SHA512 ccd8b43a084455fc19031c491fb2811c3b99c3bfd5e33afc28b370506a73bab38774c685d149dc9f6d4fc3ad55d80a4e8bc09adca8542c7b9eae7651d2a658d6
SSDEEP 49152:h1OsCzo7LZeVbAgQNwnUMJjwul2b4moYP0:h1OuSbqNwnUMJjB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1016	gKNTdBky8oKYdjN.exe

Loads dropped DLL 3 IoCs

pid	Process
1016	gKNTdBky8oKYdjN.exe
780	regsvr32.exe
2992	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfmfmagdchbaobfakgejmhpdehdgkajd\2.0\manifest.json	gKNTdBky8oKYdjN.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfmfmagdchbaobfakgejmhpdehdgkajd\2.0\manifest.json	gKNTdBky8oKYdjN.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfmfmagdchbaobfakgejmhpdehdgkajd\2.0\manifest.json	gKNTdBky8oKYdjN.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfmfmagdchbaobfakgejmhpdehdgkajd\2.0\manifest.json	gKNTdBky8oKYdjN.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfmfmagdchbaobfakgejmhpdehdgkajd\2.0\manifest.json	gKNTdBky8oKYdjN.exe

Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	gKNTdBky8oKYdjN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	gKNTdBky8oKYdjN.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	gKNTdBky8oKYdjN.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	gKNTdBky8oKYdjN.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.tlb	gKNTdBky8oKYdjN.exe
File opened for modification	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.tlb	gKNTdBky8oKYdjN.exe
File created	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.dat	gKNTdBky8oKYdjN.exe
File opened for modification	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.dat	gKNTdBky8oKYdjN.exe
File created	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.x64.dll	gKNTdBky8oKYdjN.exe
File opened for modification	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.x64.dll	gKNTdBky8oKYdjN.exe
File created	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.dll	gKNTdBky8oKYdjN.exe
File opened for modification	C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.dll	gKNTdBky8oKYdjN.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1016	1252	aa27642d1c4df01e6e49959277503c87_JaffaCakes118.exe	82
PID 1252 wrote to memory of 1016	1252	aa27642d1c4df01e6e49959277503c87_JaffaCakes118.exe	82
PID 1252 wrote to memory of 1016	1252	aa27642d1c4df01e6e49959277503c87_JaffaCakes118.exe	82
PID 1016 wrote to memory of 780	1016	gKNTdBky8oKYdjN.exe	86
PID 1016 wrote to memory of 780	1016	gKNTdBky8oKYdjN.exe	86
PID 1016 wrote to memory of 780	1016	gKNTdBky8oKYdjN.exe	86
PID 780 wrote to memory of 2992	780	regsvr32.exe	87
PID 780 wrote to memory of 2992	780	regsvr32.exe	87

C:\Users\Admin\AppData\Local\Temp\aa27642d1c4df01e6e49959277503c87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa27642d1c4df01e6e49959277503c87_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\gKNTdBky8oKYdjN.exe
  .\gKNTdBky8oKYdjN.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\GoSAveu\XyrywicPf4fNTr.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XyrywicPf4fNTr.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\XyrywicPf4fNTr.dll
Size 616KB
SHA256 6f9bd8b86ca535dd27a8f0025caf16837105636c0afc480be7c318fae04d929c
MD5 51779342c813de01418a87c8514f379e
SHA1 3b0c2a60cd239b3fcdfa0eef7bab2e0c83eb608b
SHA512 175260f48bc829fa8e4b4dd820883de92228a721642c74ffbc6cfbc00a7fe321ef85982dd424fed64040824b1792598f9125a0d85c993983407fc6f5af2b5e45
SSDEEP 12288:sQnnQQWaTnIbtU3+LAr7NjFgPSJ1AtlZ4vNHjL:sQnnQQWwnUMJjFIu+tlul
MD5 SHA1 SHA512 SSDEEP

Submit Download

XyrywicPf4fNTr.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\XyrywicPf4fNTr.tlb
Size 3KB
SHA256 3ef44805d5bee6a1a5c9201ce50705f09f276d1a6be4ab7d57a28c56bbe4e906
MD5 f9a1b60225225fbc64f54978259b997b
SHA1 9552c558f42ca16ed4a3d290262308ee83c011c7
SHA512 fe8d14d63d34e39a7e28f31d4b3be86e166b993fb37ad4dd4602cc14f1d108fe0e7e7370d019f9d41e3ecf07591c21c785dd6a7d3a88589f2605963e5be6eb8e
MD5 SHA1 SHA512

Submit Download

XyrywicPf4fNTr.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\XyrywicPf4fNTr.x64.dll
Size 694KB
SHA256 1c01de8b7318232ab1b273faf99edbdd7d72da0a97f60cc66a510b51fb1d7242
MD5 ee58e0c137b96ee066736011352b13d6
SHA1 76f487f677d1c2052e5a0304816277aeabce7a9e
SHA512 4651c2bb6bbad507e2da75f4cd4fdd84f62a4ee8d5b125c4bb6311c5509fdce0e258df9dd6c9d8685a4c9ccc33536d3b89cc33416e6b8a24b6df4ef15c662150
SSDEEP 12288:qcqQBM55kAr8v9QALpWygtOw/Xh74p/kroG0e6uIpa:SQG55kg8v9QAdWyg9v1ukroBe6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

V.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\bfmfmagdchbaobfakgejmhpdehdgkajd\V.js
Size 5KB
SHA256 dbe7fb456771df6bb822bd76ce9f029c4d2b31b65c8b0fd1723500c4f975c09e
MD5 a0f8b09092ff895fceb315ad9e5aa265
SHA1 dbdcb8070cd35325955a65adbb137a30eb922000
SHA512 9e091c1b7152707301b3b387dac8a7cc91841e5c15658f4be10bce9bce99e984d33213bdba9b14913e52e67fb9cc13b9517da6f54c9ba75268b34b0a5ec5a606
SSDEEP 96:93c7HJJ0vOai0NxOT5fUAYuKeIusuouiuGWN0wvpjeXY9CLK:93c7xVfUAY/eIdtfL7qpIY9CLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\bfmfmagdchbaobfakgejmhpdehdgkajd\background.html
Size 138B
SHA256 d532a887e4d2bf6f301a48ae7dba950259076bd75359231578e320b894fc36d7
MD5 3277689f25674eb8e3246ad1de2669cb
SHA1 b413511c9dedaf14d3635ad6e5f5e150c6d6d124
SHA512 fe45d730d5d57f6f2448c0db979e3da602b57e1602084ce7684139f0ddbff172bd25455efc86bcf873eada1aa4625042775e2ec820d707cbd6406c1691f15268
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\bfmfmagdchbaobfakgejmhpdehdgkajd\content.js
Size 144B
SHA256 332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
MD5 fca19198fd8af21016a8b1dec7980002
SHA1 fd01a47d14004e17a625efe66cc46a06c786cf40
SHA512 60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\bfmfmagdchbaobfakgejmhpdehdgkajd\lsdb.js
Size 531B
SHA256 ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
MD5 36d98318ab2b3b2585a30984db328afb
SHA1 f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA512 6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\bfmfmagdchbaobfakgejmhpdehdgkajd\manifest.json
Size 499B
SHA256 2d4ed6e425a1a6fd2b91d1597c1eac9f1f7f2161a7f6bf326d7c63aba21d3a60
MD5 e2d0ad70b1619a44012b08008f4e208d
SHA1 4fc009b9019e3bd84ec1c1d7d0e43dfd008e9829
SHA512 b1d6283c3f4ac0033b9794920a0eb25d674bc79b20e2e4e819baf5aa5e790aff7d14460559b260a248f1e4edb96e8ac7b89daa5c85e15fb19d361371b559845b
MD5 SHA1 SHA512

Submit Download

gKNTdBky8oKYdjN.dat

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\gKNTdBky8oKYdjN.dat
Size 6KB
SHA256 52ea26af7ac4602518ac71ed0088d9b5547bb15cb7da9c5929bce5f0b6534239
MD5 3468fe8959b04841cd934fb5630c0ee2
SHA1 55ecee2549ef41050da0d707ad040be6c913af28
SHA512 09810fd38589fa2004020c4e8b618e66a00a045be95fd11019a7e656fb61ad5ef06d72f95a0f6bd62477850edfb0825a54b8b11160743671b4bb80faf3aee78c
SSDEEP 96:SksZfRhMbRy/QlRFrj6o3NLJhJPQpe6zFb6YoKf5MGJJFwjc0:SkOf4FaopOYQQY3f5M9
MD5 SHA1 SHA512 SSDEEP

Submit Download

gKNTdBky8oKYdjN.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\gKNTdBky8oKYdjN.exe
Size 621KB
SHA256 d3bf5a3be663a23e299df859e269583380150a3e56ea54f8f86a6c4f2c2f41c3
MD5 668fff59a29c4d884eda0b336a894267
SHA1 c41ea9f2279b2270686ef669902a5dcce228babc
SHA512 0ef69540cc2d2ad456311f95539ab649535e97efe089a8490111c13da0e3db430ea11f18812c90416150400de3b7491dd5fcf6cc341752d4a112555067df5729
SSDEEP 12288:Xsep168vd+Y0Ceb7X5lLVfOJKMeGFNStEJsz6nO+Av:Xrp16ooY0Ce35lLVfOJKdtIA6nbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\[email protected]\chrome.manifest
Size 35B
SHA256 f2ef051ab49cd649df5822d4c676e39a5236023c4b353591665e863c6e0d8ffb
MD5 7fb49ec49e192bedcb8b5d2720572a9e
SHA1 9ae3cdd515ad16d2a8ab826adeddf140bbb4892f
SHA512 7958ea2fe387fbf3f59581fa25922de3cebe8be3b86314fa93ed28ddefc21e3a0dab9b5ae6f9840ae27b92b60c8061f73bf6def49fbb99a32f83ef466775dfc0
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\[email protected]\content\bg.js
Size 7KB
SHA256 533fc581692bf18d485228e149ec3d91008bb68125fc5238845ccdd0bf99ec40
MD5 e12cff670af9676263d14c69586a9484
SHA1 a01a44004e4f361ae562bfc0eb24f85ab52ffe45
SHA512 71a3bdcaefe2fc41bbde4beed7b5a360fa711e384d3c4bb536c705eaf7a28fe452f916dff8c8e397365c427c1f395dfc955ef09a7ee4487c34ad36bedf84eb37
SSDEEP 96:Lc7CJJ30OMs0NxwTsnv48VE6zp+HrFlYuKeIusuouiuAWNMwvpQXY7DLkH/3j94:Lc7gInv4rEWfY/eIdtf7VqkY7DLOW
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS4055.tmp\[email protected]\install.rdf
Size 597B
SHA256 40714bd361a57b5fcff034c5fb6d051832124935815cf2287edb4f4a9c700158
MD5 8186b7c7e9066f1a6dd0cbcca7481306
SHA1 ab2f6fab933a14595cefc350ef2b9015869d4ec8
SHA512 46640a5af021d1caae5289efcf9383b4027af57ace69f1dc5bbf00662d9419f20a7d40e088009095dbc6da477fbefa464a7992ad8f4986f845104abf92884265
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads