cd60c387df1689edf62a2d98e58c7d955d94c234b6dd04d2ecdb478c9d6810fc

General

Target

1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Size

156KB
MD5

1b55174b865564718d137e1fe0cc385f
SHA1

aa4a7118602b5afbc42260b4acd62f990c9bf4a2
SHA256

cd60c387df1689edf62a2d98e58c7d955d94c234b6dd04d2ecdb478c9d6810fc
SHA512

77eb9129a5a55d3c23ca8030b941015476468e12ce04fdd4cdafd4ab2ef7724add1622f04588f59f437f7e437c44348fff75c8105790d1810d5b7035e9a5a164
SSDEEP

3072:VqynIkB3leohhyqAwSPBH+GD4HCGrFEJwcNlVi:8U9rx8H+yGOKcNlo

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023269-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2136	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023269-1.dat	upx
behavioral2/memory/2136-4-0x0000000010000000-0x0000000010060000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxml71.dll	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Windows\\SysWow64\\msxml71.dll"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBDD741E-2CC2-E987-F8B9-BC77991C520E}\.0\ = "C:\\Windows\\SysWow64\\msxml71.dll"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBDD741E-2CC2-E987-F8B9-BC77991C520E}\.0	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBDD741E-2CC2-E987-F8B9-BC77991C520E}\.0\ = "XML Library"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBDD741E-2CC2-E987-F8B9-BC77991C520E}	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{DBDD741E-2CC2-E987-F8B9-BC77991C520E}"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK"	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b55174b865564718d137e1fe0cc385f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3812 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:11456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msxml71.dll

Filesize
126KB

MD5
1b9450bbad0ac738bab34d5fcbb67826

SHA1
57636d43e8c9891618f019fc73105322de908abb

SHA256
0aaa3fa94950ac6ae9bb6a14648b1d98078fb00f097bca4a80a5a312e9cde539

SHA512
d08ca1ddd8a6493bd1f3aa2862f19bf5af71a1b4f5d6b5583571b968080b4ad886eea2dff75b71689077eca437bebd9f642bf189a78f5278d69033bbd88866ff

Download Submit
memory/2136-4-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing