cb1a4b72d24301acd56898f69d6ba3d50498bf1cfa3a7b044a1289ba22224eb9

General

Target

035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Size

171KB
MD5

035be4afc1bd2c5fb62634314d6e9623
SHA1

93bd3067c12d5143d4b486af3f73e7f62af9353e
SHA256

cb1a4b72d24301acd56898f69d6ba3d50498bf1cfa3a7b044a1289ba22224eb9
SHA512

ad35985745574def75e2841ea4d0dabc6317af2468518ce0242bd081ae3265c5bd329e89071f8cdb3947a787ce752f4cc0fae512f1257adf257b5a009cbfad8e
SSDEEP

3072:b6wPEx+nxqQaveGj8fNs1uzkt42GeFNfhNyRe1cGLn2XmnDM1N5ognP:GxEqHeq8V9Iuh45N+e1L4mDuN5og

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cltmon = "C:\\Windows\\system32\\cltmon.exe"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logon = "fnGbf2"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Shutdown = "fnGbf2"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\DllName = "C:\\Windows\\system32\\omhdt32.dll"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Startup = "fnGbf2"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\StartShell = "fnGbf2"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logoff = "fnGbf2"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Asynchronous = "0"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Impersonate = "0"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\Temporary Internet Files	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\remdsk	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\omhdt32.dll	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\odTxt.dat	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cltmon.exe	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\omhdt32.dll	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dllcache\smdata32\odTxt.dat	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\msn	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\inf0z	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\tr4ckd	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\fxddsk	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
3804	035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\035be4afc1bd2c5fb62634314d6e9623_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies WinLogon
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gbf1.tmp

Filesize
17KB

MD5
573afac0a8420c5019d8adcfdd9c04f6

SHA1
533147404d575baa0300491cfa5ad442a3ca5548

SHA256
05c6b5febc0e815a02ba8ef348d3f28d079a3cfbc4b9e3442edf4225baad8b7c

SHA512
db3e3077ab5c8fc1d4e1fdb28088af97c1fe31bc59df6716fc91b9dfc09c2ffda7a42682150f253a0c51bb6c515a93cc9f35033989aff7343547b257047e394c

Download Submit
memory/3804-0-0x0000000000400000-0x0000000000466921-memory.dmp

Filesize
410KB

Download
memory/3804-11-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3804-10-0x0000000031200000-0x0000000031218000-memory.dmp

Filesize
96KB

Download
memory/3804-12-0x0000000000400000-0x0000000000466921-memory.dmp

Filesize
410KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads