e73503a7d55049ca20d66764c19305249c1263794ec8288dacbbc9dff142ad89

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Size

414KB
MD5

08c278c88b5991c3c6c416fb7e591ab1
SHA1

2c3eb82bdf16594692b1cb7a62e26761ce214b43
SHA256

e73503a7d55049ca20d66764c19305249c1263794ec8288dacbbc9dff142ad89
SHA512

ddb1db1b0078dd2d4da0b4fb65e369ebad1ae280bba4af72bc9d7f57dd5fed213c112de338b08dcc32c88fddf0f19d3b795a1d2878c8ffe0d2a608f844cb7059
SSDEEP

6144:m+NdM4iDLsJMSU5Csdcuj4Hmudg9FSunh4jF6GGbYg7DQrmWSQR5i6Plgh:McINOujQWFSuGx6jbYggrmWRu

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x001800000001386d-23.dat	acprotect

Deletes itself 1 IoCs

pid	Process
3048	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2840	winupdate.exe

Loads dropped DLL 2 IoCs

pid	Process
352	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
352	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/352-0-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/files/0x001800000001386d-23.dat	upx
behavioral1/files/0x0007000000013d74-49.dat	upx
behavioral1/memory/2840-54-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/352-78-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/352-87-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2840-89-0x0000000000400000-0x00000000004C7000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E730189A-9973-4121-B046-AD1C161EC3AF}	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E730189A-9973-4121-B046-AD1C161EC3AF}	winupdate.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\37211.dll	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\37211.dll	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sncool.scr	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sncool.scr	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\37211.dll	winupdate.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\winupdate.exe	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
File opened for modification	C:\Windows\winupdate.exe	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\	winupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	winupdate.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE\Classes\htmlfile\shell\opennew	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE\Classes\htmlfile	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE\Classes	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}\InprocServer32\ = "C:\\Windows\\SysWow64\\37211.dll"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE\Classes\htmlfile\shell\opennew\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}\InprocServer32	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}\InprocServer32\ThreadingModel = "Apartment"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE\Classes\htmlfile\shell\opennew\command	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\37211.HahaPP\	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}\ProgID	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}\ProgID\ = "37211.HahaPP"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\opennew\command	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command\CLSID\{0002DF01-0000-0000-C000-000000000046}	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\37211.HahaPP	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command\CLSID	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\""	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\37211.HahaPP\Clsid	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\37211.HahaPP\Clsid\ = "{E730189A-9973-4121-B046-AD1C161EC3AF}"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" -nohome"	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\SOFTWARE\Classes\htmlfile\shell\open\command\SOFTWARE\Classes\htmlfile\shell	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E730189A-9973-4121-B046-AD1C161EC3AF}\	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\htmlfile\shell\opennew\command	winupdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 3048	352	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe	29
PID 352 wrote to memory of 3048	352	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe	29
PID 352 wrote to memory of 3048	352	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe	29
PID 352 wrote to memory of 3048	352	08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08c278c88b5991c3c6c416fb7e591ab1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\win_pop_flag_1__1.bat
  2⤵
  - Deletes itself
  PID:3048

C:\Windows\winupdate.exe
C:\Windows\winupdate.exe
1⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winpop.ini

Filesize
528B

MD5
af30b9a75c857b0877a66f1902401565

SHA1
64be95f9d730b58ee2e56916ef033647b6028a10

SHA256
c1af01dc3f7d82e1c17a69b08a646cb570382290181091376fc459e409274719

SHA512
bfe7129699b9e424eb92f79852b748b8441a4aeb19b3f17b21c40b88214b409a40721791ec846fd412fb33724e526515f3dd966f491afb06fcb9d92d39a69fe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\winpop.ini

Filesize
528B

MD5
b46a12e59da4474f691b5e76c5167467

SHA1
bc7f4350fd408d5fd922ee38897db98260dccb71

SHA256
54d781ceafe02a3352722e90c578db0762183411acd7547868fd06f2907619cc

SHA512
2b4a8805adc58aef0b5779a88f35fa52d3c448b1073e77c6d40b7808d731a454b1a7cd35d908919e9d10ad25594e90d4324bec86d1d6e4439ac493c126ba5924

Download Submit
C:\Users\Admin\AppData\Local\Temp\winpop.ini

Filesize
581B

MD5
6ada4dbdb55343c684af0a5d8cbda072

SHA1
ae5236e5f2107fb2c8234e87cc2ad5319b97f1e2

SHA256
a0e6e4758a71eaff5856579ef9ae4b9752ecfaa8c2098071b0f36e22671c7ab5

SHA512
0c5e7e3a7959ac115954469f23e2d13fca187d5fa91866a29266131c2e6f74b5a74482649d4f46de9c0078ffc64a73110827f97d1d7f9537cb99b4edb59b1ea6

Download Submit
C:\Windows\SysWOW64\sncool.scr

Filesize
414KB

MD5
08c278c88b5991c3c6c416fb7e591ab1

SHA1
2c3eb82bdf16594692b1cb7a62e26761ce214b43

SHA256
e73503a7d55049ca20d66764c19305249c1263794ec8288dacbbc9dff142ad89

SHA512
ddb1db1b0078dd2d4da0b4fb65e369ebad1ae280bba4af72bc9d7f57dd5fed213c112de338b08dcc32c88fddf0f19d3b795a1d2878c8ffe0d2a608f844cb7059

Download Submit
C:\Windows\win.ini

Filesize
530B

MD5
45fcf6a46a2d226a08aac0d93242de8a

SHA1
bc67539d1b5848ca5a5586c49dcfb3df018e694a

SHA256
93c9624ae06be12f2f1d28a4dbf5dd0828899f6d9da2ee3c3784ac1890d752c7

SHA512
a41683d121855e37d8fe08ac30d6fc792e540ce5ad58fcfcf1cd6fb879358e3da7732bb3e77034446e68bd648ca5893dabb5d1b7cc251327cff3ea7e0f0c6d59

Download Submit
C:\win_pop_flag_1__1.bat

Filesize
434B

MD5
929bf6528905cd14fe4d0384cab06b9d

SHA1
a478059e640038c8696e60d93a478a33eb5d623a

SHA256
41af6f29da5ea6b496b4578778b92f63295d2d05d86b4144049285b7a681302a

SHA512
2ee6a69a6e03d53152b007f60c9b2a3913a8ada3c0bb7e2c5593d003a04e5793dc59407bac1c4da61d90970f2b5a3776c08e8c340a4328dee5d79632aad67245

Download Submit
\Windows\SysWOW64\37211.dll

Filesize
189KB

MD5
e87d0d33792f7d4653c1929ec5ef371b

SHA1
f8fa0f3948d443b77b539cb0fba6021f85d7b5e2

SHA256
9cc91cf914f352b494c185938e027e310521114fe84f21ef25aad15468b33736

SHA512
cd35ad995722e72923335cbe221f9b04b7259e7679a6efe194e34e285ce4d056eea8673d379b428e762cb58303dc3a2c8d27ca3852d4bc2cd9767bb0572dcdc8

Download Submit
memory/352-78-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/352-42-0x00000000032D0000-0x000000000334F000-memory.dmp

Filesize
508KB

Download
memory/352-41-0x00000000032D0000-0x000000000334F000-memory.dmp

Filesize
508KB

Download
memory/352-0-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/352-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/352-87-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2840-54-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2840-71-0x0000000000230000-0x00000000002F7000-memory.dmp

Filesize
796KB

Download
memory/2840-89-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads