Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
priam_bho.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe
-
Size
129KB
-
MD5
02d241f84e7879b299257b722ae7a15f
-
SHA1
7f3123f9486ab1db721227c96d34c13af7dc96bd
-
SHA256
fbf40e91716ab1130824e6c8e668185c02202da7554ffd1534ce0fd8ad4064fe
-
SHA512
d2dee67bff1934f8f0d33f56855318d7d5ad7c7e86edae776a498389654c8b497c4dd11008c36798c1d2f4692a455079262bda7eb9518e93ccf300d093649f1f
-
SSDEEP
3072:0stajHKBvYXJLMC2KNT7mUnfopPu6k9XQTN5Zk8n4i5mNnWS2nuQ:0Tq+72e3mUnx6iaN5Zk8n41nWsQ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2340 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\ = "Wajam IE BHO" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\NoExplorer = "1" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Wajam\IE\nsi1CB6.tmp 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe File created C:\Program Files (x86)\Wajam\IE\priam_bho.dll 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32\ = "C:\\Program Files (x86)\\Wajam\\IE\\priam_bho.dll" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\TypeLib\ = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ProxyStubClsid32 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32\ = "C:\\Program Files (x86)\\Wajam\\IE\\priam_bho.dll" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO\CurVer\ = "wajam.WajamBHO.1" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32\ThreadingModel = "Apartment" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\TypeLib 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\TypeLib\ = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ = "IWajamBHO" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\TypeLib\ = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\HELPDIR 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\FLAGS 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}\ = "Wajam" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\VersionIndependentProgID\ = "wajam.WajamBHO" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader.1\CLSID\ = "{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\VersionIndependentProgID\ = "wajam.WajamDownloader" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO.1 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\ProgID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader.1\ = "WajamDownloader Class" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\InprocServer32\ = "C:\\Program Files (x86)\\Wajam\\IE\\priam_bho.dll" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader\CLSID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\FLAGS\ = "0" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\priam_bho.DLL 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO\ = "Wajam" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO\CurVer 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\InProcServer32\ThreadingModel = "Both" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\VersionIndependentProgID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\Programmable 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\VersionIndependentProgID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\NumMethods 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader\ = "WajamDownloader Class" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\0 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\ = "PSFactoryBuffer" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\priam_bho.DLL\AppID = "{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO.1\CLSID\ = "{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader\CLSID\ = "{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\InprocServer32\ThreadingModel = "Apartment" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\TypeLib 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamBHO.1\CLSID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\ProgID 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\TypeLib\ = "{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Wajam\\IE" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader\CurVer\ = "wajam.WajamDownloader.1" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader\CurVer 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\ = "WajamDownloader Class" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}\1.0\ = "wajam 1.0 Type Library" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}\TypeLib 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wajam.WajamDownloader.1 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}\ProgID\ = "wajam.WajamDownloader.1" 02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02d241f84e7879b299257b722ae7a15f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD5d0e747bba0d8c4b77a174642c0396117
SHA19acf3100a833118719234a60ce92fbf85c1e3f57
SHA256e91dea558ab738b9fc39e70071c057fbd3b6d8ce4639a913422acf3da8957d6a
SHA512fe43071c9db87a0de62827be2591bc84e1abbe3abcfe59ca1bcc7d8f5b1bee3aa82170a3dd0c56f333814798521330c7f5e5523f206b68315984af27087115ec