adc18303d348ca92f343a6b22b4788fbe234b163ee22860e95694afa9aba3316

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Size

98KB
MD5

251632d2a887f2fdfa3f16069a3a315c
SHA1

bb7ae2eced0493dccf446bcdfddc36677e90fb62
SHA256

adc18303d348ca92f343a6b22b4788fbe234b163ee22860e95694afa9aba3316
SHA512

fac1df82319afc463c11d21a284df8b16936b1771eed4705b92c78b0585e8b69741175e35cef28f1e0d26ae577a4f3bb0cb958c3d7a51755995d089fc608be4c
SSDEEP

3072:kWeyuJoPOIAXzzEUKnkbnq13DTVennGL2o8xnNrk24y9:V3osXqnqKHo8xnG

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gbpdist\ImagePath = "\"C:\\WINDOWS\\system32\\gbpservice.exe\""	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\GbpDist.dll"	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d9ad1747-7b19-4dea-bc02-0ab12c4fc468}\InProcServer32\ThreadingModel = "Apartment"	251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\251632d2a887f2fdfa3f16069a3a315c_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3716-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads