f8e91fee4f5bd95fa7248c0ef2289e901578e27141905df3b75d77cd4b191a22

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Size

326KB
MD5

33aef1253e60a0fc43c0d7ca5f0545b5
SHA1

2fc1d1a1d9db3bbd0704730a64fbc0970fd67567
SHA256

f8e91fee4f5bd95fa7248c0ef2289e901578e27141905df3b75d77cd4b191a22
SHA512

a8eae9840ba8db3354b51df6b1a7507f18745d4c29b1c4b9eff6ac692384c69637c04564968613e5565602fa2cd4b8af63f901ee980a4ff09361bff574aeb1ba
SSDEEP

6144:cs9he7YCtLya0/gYkmdT6e2m2mqCyCy2OG+CvebsDsvqf9q2+r8FiFYwEKik:5fTj//vXh9qr8Iik

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\NoExplorer = "1"	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Shared\lib.dll	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\InprocServer32	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\InprocServer32\ = "C:\\Program Files (x86)\\Shared\\lib.dll"	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\InprocServer32\ThreadingModel = "Apartment"	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\TypeLib	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\TypeLib\ = "{8E3C68CD-F500-4A2A-8CB9-132BB38C3573}"	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\ = "Browser Helper Object"	33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33aef1253e60a0fc43c0d7ca5f0545b5_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads