1259e5930f3103c19f152eb05cd07fed32686bd61ca0e70218f882d0b9592539

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
Size 53KB
Sample240619-131k2sycmp
SHA256 1259e5930f3103c19f152eb05cd07fed32686bd61ca0e70218f882d0b9592539
MD5 00ce47ba30cd4e70244ba7d2f7a17d95
SHA1 67765d88870150a82e0f5d042a6024379d9bcffe
SHA512 82752b691f21ed694f941f718ff0a72a86366930c073dd7dde31768a9021ff16ed09aaa8829e8225e79a707c3b8dda32941c39fd21a8f5f179e1739b5f3b5672
SSDEEP 768:6IqaG9molShhLPvluk7sCFI3f4vBGjqhd7BD6mOO:waG9mxLHluMsC0fiBGWd7BD7
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE083}	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE083}\ = "Acrobat IE Helper"	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system\ctldlg32.dll	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083}\InProcServer32	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083}	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083}\InProcServer32\ = "C:\\Windows\\system\\ctldlg32.dll"	00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00ce47ba30cd4e70244ba7d2f7a17d95_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads