adc18303d348ca92f343a6b22b4788fbe234b163ee22860e95694afa9aba3316

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Size

98KB
MD5

251632d2a887f2fdfa3f16069a3a315c
SHA1

bb7ae2eced0493dccf446bcdfddc36677e90fb62
SHA256

adc18303d348ca92f343a6b22b4788fbe234b163ee22860e95694afa9aba3316
SHA512

fac1df82319afc463c11d21a284df8b16936b1771eed4705b92c78b0585e8b69741175e35cef28f1e0d26ae577a4f3bb0cb958c3d7a51755995d089fc608be4c
SSDEEP

3072:kWeyuJoPOIAXzzEUKnkbnq13DTVennGL2o8xnNrk24y9:V3osXqnqKHo8xnG

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gbpdist\ImagePath = "\"C:\\WINDOWS\\system32\\gbpservice.exe\""	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\GbpDist.dll"	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ThreadingModel = "Apartment"	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Progresso.exe

Filesize
81B

MD5
5fa23ea9f65e3a772b747fa0e6234308

SHA1
38ca219048e780e37af31d1348c441dd5fce26a6

SHA256
b2417070d2bf6f9b3fcfa9c4b2c602d4b76067f53134dfcfd1d2a14af0655f81

SHA512
1734fa9b5dd955a31ce9a56123b561a82e4dbe0daf622d89ca1120101bbd3fa63b149851a3009524da46aa9ba4bca5bee4a849edf7a01683d6e990fcf1edb5fb

Download Submit
memory/1488-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads