9371d4f137b3a7ea0ea83654828eb66192adf99c4a5fea4aeb92789e450d9831

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Size

258KB
MD5

2f711b6459f62b699e04b09110b05286
SHA1

64cdf1ef477dff22c53d3843b6bd829e7d127758
SHA256

9371d4f137b3a7ea0ea83654828eb66192adf99c4a5fea4aeb92789e450d9831
SHA512

8ef42ad75b2ca968920bba22097c5ee9d3b142a7b8fd6b1090cfd1982619eaac3c4f36f389dc452ccf7e910b0caa1b1e0d39ab363b93af1824a2914fcb3a92e8
SSDEEP

6144:9QqmCtAbzwr4rtlz6a5A/eQDdpBHSwomwkeCj:iCtAAcwa5AeeftNjj

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2944	regsvr32.exe
3032	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\ = "Z-opti Browser Enhancer "	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3FB7637C-645D-4D82-910F-16D36410D13E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3FB7637C-645D-4D82-910F-16D36410D13E}\ = "Context-Ads Browser Enhancer "	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3FB7637C-645D-4D82-910F-16D36410D13E}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}	regsvr32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\$KAHBLTLL$\unopt.exe	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
File created	C:\Windows\$KAHBLTLL$\butfc.dll	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
File created	C:\Windows\$KAHBLTLL$\gqpwk.dll	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3FB7637C-645D-4D82-910F-16D36410D13E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\ProgID\ = "chkvajhsdhst.chkvajhsdhst.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\brxumajhsdgrm.brxumajhsdgrm.1.0\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C060B2B2-DCD2-446B-A671-E09775794BF2}\instl\data\SFTID = "38f5502955ed41aba8fcb90706830197"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\brxumajhsdgrm.brxumajhsdgrm\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D4F9DCF8-8AE7-41A0-BCF4-490D0B30FAA6}\apps\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\ = "C:\\Windows\\$KAHBLTLL$\\butfc.dll"	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl\data	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3FB7637C-645D-4D82-910F-16D36410D13E}\ProgID\ = "brxumajhsdgrm.brxumajhsdgrm.1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\ = "chkvajhsdhst Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\VersionIndependentProgID\ = "advfajhsdpr.advfajhsdpr"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst.1.0\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst\CurVer\ = "chkvajhsdhst.chkvajhsdhst.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\Instl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr\CLSID\ = "{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\InprocServer32\ = "C:\\Windows\\$KAHBLTLL$\\gqpwk.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr\ = "advfajhsdpr Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst\ = "chkvajhsdhst Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C060B2B2-DCD2-446B-A671-E09775794BF2}\instl\data\afltId = "mc1127b"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl\data\afltId = "mc1127b"	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\brxumajhsdgrm.brxumajhsdgrm\CurVer\ = "brxumajhsdgrm.brxumajhsdgrm.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\ProgID\ = "advfajhsdpr.advfajhsdpr.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\brxumajhsdgrm.brxumajhsdgrm.1.0\ = "brxumajhsdgrm Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C060B2B2-DCD2-446B-A671-E09775794BF2}\instl\data	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\brxumajhsdgrm.brxumajhsdgrm\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3FB7637C-645D-4D82-910F-16D36410D13E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr.1.0\CLSID\ = "{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst.1.0\ = "chkvajhsdhst Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\TypeLib\ = "{2D165C7B-6177-4C18-8691-6B12B8947FD3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3FB7637C-645D-4D82-910F-16D36410D13E}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\TypeLib\ = "{2D165C7B-6177-4C18-8691-6B12B8947FD3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\chkvajhsdhst.chkvajhsdhst\CLSID\ = "{4FD19729-FC3B-4298-958F-BBDD467E7C8F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\InprocServer32\ = "C:\\Windows\\$KAHBLTLL$\\gqpwk.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C060B2B2-DCD2-446B-A671-E09775794BF2}\instl	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\Programmable	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C060B2B2-DCD2-446B-A671-E09775794BF2}\instl\data\instlDay = "19913"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl\data\PRDCTID = "adPro"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl\data\afltId = "mc1127b"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl\data\instlDay = "19913"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D4F9DCF8-8AE7-41A0-BCF4-490D0B30FAA6}\apps	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D4F9DCF8-8AE7-41A0-BCF4-490D0B30FAA6}\apps\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr.1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\VersionIndependentProgID\ = "chkvajhsdhst.chkvajhsdhst"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3FB7637C-645D-4D82-910F-16D36410D13E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C4E0BAC8-B737-4D0C-9BE5-D74474167FC4}\instl\data\HRDID = "88a7404eb0e9f238000046fe39dd2993"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\advfajhsdpr.advfajhsdpr.1.0\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F3CE27F-2305-4EE8-BE69-316E73FEB9A0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD19729-FC3B-4298-958F-BBDD467E7C8F}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3FB7637C-645D-4D82-910F-16D36410D13E}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 2944	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	28
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29
PID 2564 wrote to memory of 3032	2564	2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f711b6459f62b699e04b09110b05286_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Windows\$KAHBLTLL$\butfc.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:2944
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Windows\$KAHBLTLL$\gqpwk.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\$KAHBLTLL$\gqpwk.dll

Filesize
284KB

MD5
a604a413255803756fee02e221604460

SHA1
f1676e71ede1305e192d1af5aa75c12d7e073ef5

SHA256
de83c043724b59216d2968e8bf735d0670d5ddcfd87b7e274a7ff52f797ef9cd

SHA512
9f522f0356e849507582cbec5712adae0c5f609f8729fa4c0ce3bc645b93dcad9123f9a0b3c3d55a590b629e735a3db762305e14f875158c020e78e59c23ef5c

Download Submit
\Windows\$KAHBLTLL$\butfc.dll

Filesize
235KB

MD5
f4e17dd5b099184e19bdb3518f1829f3

SHA1
81856982429f8bfea37ab93add8cfeb348a45a9e

SHA256
7cc68b309bb5b49a0967b22b2a38752a47eb6fff4e70406676f3667e791c30f2

SHA512
305abc93c0369367f76701fd616ac73f46bf5aff0c5e6e34e27794ce66e6cbccc367640e8768d901b6cc12dd5fd8b67cafc9f20dcae91482de6f5bf316e6403b

Download Submit