1898c537d2b5d3e4085dd5f8d574a9b53ec1dd0fbc201dde3ae85777f2f57e8b

General

Target

32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Size

405KB
MD5

32087ae9d6ef097b8a467f25af28203b
SHA1

a9d39593507f6e5647d42c53e9eab5ce07ced744
SHA256

1898c537d2b5d3e4085dd5f8d574a9b53ec1dd0fbc201dde3ae85777f2f57e8b
SHA512

78f410bf8116e9e9c82d7343a7d1bfebfe7b0caafba638a2ada5ab5291ded24dd78d1f4a6b438ee4134decdda7bd1194c78adb954d2587ffac519810d7eaf503
SSDEEP

6144:N+n6P42fVm9K/fNX/YpCyTZuFsWOoS/U90Obdul9a1yl+aqlTt3/airzp6cjcI:86LN3pWtvoS/U6h9aqJqlTwkzp

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b00000002341c-5.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
2932	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
2932	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000400000-0x00000000004F3000-memory.dmp	upx
behavioral2/files/0x000b00000002341c-5.dat	upx
behavioral2/memory/2932-8-0x0000000003EB0000-0x0000000003F80000-memory.dmp	upx
behavioral2/memory/2932-11-0x0000000000400000-0x00000000004F3000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EB49E638-95ED-4F96-A3D9-E601627BBDE6}	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\livemss.dll	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\SearchScopes	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB49E638-95ED-4F96-A3D9-E601627BBDE6}	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB49E638-95ED-4F96-A3D9-E601627BBDE6}\ = "LiveMessenger"	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB49E638-95ED-4F96-A3D9-E601627BBDE6}\InprocServer32	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB49E638-95ED-4F96-A3D9-E601627BBDE6}\InprocServer32\ = "C:\\Windows\\SysWow64\\livemss.dll"	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB49E638-95ED-4F96-A3D9-E601627BBDE6}\InprocServer32\ThreadingModel = "Apartment"	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3624	2932	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe	84
PID 2932 wrote to memory of 3624	2932	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe	84
PID 2932 wrote to memory of 3624	2932	32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32087ae9d6ef097b8a467f25af28203b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_delme.bat
  2⤵
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_delme.bat

Filesize
212B

MD5
f04f5f7adc87ae868bb427c9c9fdd8ec

SHA1
59a2e66682c418b8852faa6c0cf2e90b00154c1a

SHA256
7a3c38eac27c328741a0f1ee2e303b0150e790ce14c6643e4bef8c766b776ca6

SHA512
a09a725bb04585ceb0ce35d25f14960151b92e9b1a08b9480a91ed37e26334894324cb5a5da2626e5489fa2d541ad7d6a8746ba25cd29b24a0e0a43c2bdfd12a

Download Submit
C:\Windows\SysWOW64\livemss.dll

Filesize
335KB

MD5
f9cd88af7e8eb292d3d999f8dc01fe73

SHA1
8078639f0eb5c3958d12a415512cd59994b90a18

SHA256
a693079b9d9678884a7eaede0179f81073d7409faa6e862de658197283954e38

SHA512
0f50aa1723f2aba233170095b1b73ccfc70d055ebd9cfa774f905aff849d8b84e143916598f51e6dea45e76007e4c7fca1b82e86a9b24cf8b0b3c161cf1b8fe0

Download Submit
memory/2932-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2932-1-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2932-8-0x0000000003EB0000-0x0000000003F80000-memory.dmp

Filesize
832KB

Download
memory/2932-11-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads