9b0b68c720d8a281414e13d25215820270518568e8f71f0e4f2a3615962acf1f

General

Target

25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Size

128KB
MD5

25cc60b4e20ef1ddb7e290028427a739
SHA1

a36622b472e69bb0b5993f5b898dff483e572c2b
SHA256

9b0b68c720d8a281414e13d25215820270518568e8f71f0e4f2a3615962acf1f
SHA512

088451d5284dc15c0714a90d228dcc87f1f7e0babcb6b8741599579d4162bc93182093a84659aac54cbbadbfed11b8e3847664419721a7952b91ba6630300f01
SSDEEP

1536:si/X33ahQw5z9SDM4wi6d8MEWGtTK/PT77wDAHMVh5EiJ897WTtXziy3EQFFgQ4:sivUQwJwDM4tfliPnM8H4Ex7OXW2TFe

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000016056-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2944	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000016056-1.dat	upx
behavioral1/memory/2944-50-0x0000000010000000-0x000000001004F000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxml71.dll	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}\.0	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{9233C3C0-1472-4091-A505-5580A23BB4AC}"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Windows\\SysWow64\\msxml71.dll"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}\.0\ = "XML Library"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}\.0\ = "C:\\Windows\\SysWow64\\msxml71.dll"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1"	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2944	25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25cc60b4e20ef1ddb7e290028427a739_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\msxml71.dll

Filesize
103KB

MD5
2bb11b6b83ad3416c4e5ffa8aa37457c

SHA1
dd3a030a94d208850aef23bc082d9076e0ecadb1

SHA256
24d4ddecb272b91e8145b03f3ec75ee2617893745de959ae91987da59857d1eb

SHA512
fe2c7e2baba5a9bed9212779e20fe5ee001a37ef9375778c2c02dabe46710354c5f3c35b5a89fb165737c6f09a4a25e1cfe111d5683ab024df981fbe6c2ce91b

Download Submit
memory/2944-50-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing