57f69785ad393bc02a027a6f9128edd297705edcc416af2e110650387ce8ea7d

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe
Size

472KB
MD5

31479a16d53e965fbb43902ddae0beb9
SHA1

c9c740ac217a33596d73db68bf5d85a425c1bd1a
SHA256

57f69785ad393bc02a027a6f9128edd297705edcc416af2e110650387ce8ea7d
SHA512

dd46224baf7b838b353c8a3181e5868e350a9c020b1f65d1bc459ca828bf4722483999e134376cc414edc229efba58a8c4f03f6e1fe8f7b89edb32518161a5d8
SSDEEP

12288:vTOAkRj7IqoRHaxYmzzxrFdLh/20lRSgi:v6AkRjyaxYmdxdLxt

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1900	A5SETUP.EXE
3512	A5SRCSP.EXE

Loads dropped DLL 2 IoCs

pid	Process
1900	A5SETUP.EXE
1900	A5SETUP.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ = "Ask Toolbar BHO"	A5SETUP.EXE

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL	A5SETUP.EXE
File created	C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL	A5SETUP.EXE
File opened for modification	C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL	A5SETUP.EXE
File created	C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL	A5SETUP.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}	A5SETUP.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\TypeLib\ = "{FE063DB0-4EC0-403E-8DD8-394C54984B2C}"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\VersionIndependentProgID\ = "AskTBar.PopSwatterSettingsControl"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}\1.0\ = "PopSwatter Control 1.0 Type Library"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\InprocServer32	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\ = "PopSwatter Settings Class"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.SettingsPlugin\CurVer\ = "AskTBar.SettingsPlugin.1"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\ = "{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE063DB0-4EC0-403E-8DD8-394C54984B2C}\1.0\0\win32\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\ASKTBAR.DLL"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\TypeLib	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE063DB0-4EC0-403E-8DD8-394C54984B2C}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton\CLSID\ = "{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\InprocServer32\ThreadingModel = "Apartment"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\TypeLib\ = "{BD04DAE0-8C1B-4cc5-9E06-22DE05C2EDA0}"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl\CLSID	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ = "Ask Toolbar BHO"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl\CurVer\ = "AskTBar.PopSwatterSettingsControl.1"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\Implemented Categories\{00021493-0000-0000-C000-000000000046}	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}\ = "Ask Toolbar"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\InprocServer32\ThreadingModel = "Apartment"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BD51AE-7E02-4916-9B12-647A92C02B7F}\Programmable	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\Version = "1.0"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\ProxyStubClsid32	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl.1\CLSID\ = "{83453071-3F9C-4ab0-BE30-EDA368D7976D}"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\InprocServer32\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\A5POPSWT.DLL"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\InprocServer32\ThreadingModel = "Apartment"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\TypeLib	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\Version	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\ = "IAskTBarSettings"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\VersionIndependentProgID	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BD51AE-7E02-4916-9B12-647A92C02B7F}\TypeLib	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\Version = "1.0"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}\InprocServer32	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\ = "{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\InprocServer32	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\InprocServer32	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\InprocServer32	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BD51AE-7E02-4916-9B12-647A92C02B7F}\TypeLib\ = "{BD04DAE0-8C1B-4cc5-9E06-22DE05C2EDA0}"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}\1.0\0	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\InprocServer32\ThreadingModel = "Apartment"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\MiscStatus	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\TypeLib\Version = "1.0"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ = "_IAskTBarSettingsEvents"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton\CurVer\ = "AskTBar.PopSwatterBarButton.1"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\Instance	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\"	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\Version = "1.0"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\VersionIndependentProgID	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton\CLSID	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl.1\ = "PopSwatter Settings Class"	A5SETUP.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib	A5SETUP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.SettingsPlugin.1\CLSID\ = "{FE063DBB-4EC0-403e-8DD8-394C54984B2C}"	A5SETUP.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1900	4004	31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe	81
PID 4004 wrote to memory of 1900	4004	31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe	81
PID 4004 wrote to memory of 1900	4004	31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe	81
PID 4004 wrote to memory of 3512	4004	31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe	83
PID 4004 wrote to memory of 3512	4004	31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe	83
PID 4004 wrote to memory of 3512	4004	31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\bar.0\A5SETUP.EXE
  "C:\Users\Admin\AppData\Local\Temp\bar.0\A5SETUP.EXE" "C:\Users\Admin\AppData\Local\Temp\31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\bar.0\A5SRCSP.EXE
  "C:\Users\Admin\AppData\Local\Temp\bar.0\A5SRCSP.EXE" "C:\Users\Admin\AppData\Local\Temp\31479a16d53e965fbb43902ddae0beb9_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL

Filesize
116KB

MD5
69a3eb924678bb23047e6248648e6534

SHA1
844949940edfa51d38c5fa3294892b92c8d3cf8e

SHA256
8150669b6e743bdc725abfd4e51c3da721e4b1a2a86ee2cda4d61f8e2bbee851

SHA512
6f3c3b4a81965a6cf462943f1c0b0c8db1fbe7b89e24459411dc279cb18d534568c2cf0097bfea6848ceca9818bf10f86c1ea4aaf601f1b1e42dbd9ec696dd06

Download Submit
C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL

Filesize
240KB

MD5
59dbfe16aa20144cb11e7fc8b2d21eaa

SHA1
b4403810c1db8482c5a26b418499a8643e4a6410

SHA256
809bbfa3fb67c79f1901b159b754dd955c5defe28d5879f91972d269d706d55c

SHA512
83ce6c1631d36ebc19be3fc178932f41fdef7c7f8a9dd5d3631527a25f894936477a053ad96d65ba58b8775732741b52af1edc390b260009775406b05df36297

Download Submit
C:\Users\Admin\AppData\Local\Temp\bar.0\A5SETUP.EXE

Filesize
376KB

MD5
f90f8e211bb2ba49218188caa1dc2f3a

SHA1
8a18eb5ec6f37f9c4f0654069815f30f651b1d8c

SHA256
024fe6f1d33edbdb2a9064564273db5e4e2bf87fa6b6380b8a118a7b110b7035

SHA512
107889d1a470a4a622a3a09ee39077d12a444c6bb90e2897e56720c722db8e926f0853bc5cbc435d211105335ea0db1d334f8811c2c6d5ad63b7072742eb4f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bar.0\A5SRCSP.EXE

Filesize
76KB

MD5
e7d9ce28eae7d5ce00878a39a7d2584f

SHA1
73b4be59997f90e3bb3e87df47efe76b10fa6a92

SHA256
87f40724067f8e3bfbb2d78962f9925ec77b83fb7763513387a016b6b1683439

SHA512
c7bffecd908007e2b53e83f444e3a685f525c022f12d8e2e3733a47f64c00e2165737450ccca4d86738c79d2104cf3ed6652803eb8fd78f36a2a26423600acd5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads