25477a857ad07267c127356fac71793a1db31dd15450388344d6f2920f0bf28c

General

Target

5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Size

604KB
MD5

5cc23a5dff34f4b8431e4ce3dd8ed51a
SHA1

c277a3263001d47d55c0cb8c7ba009556395cd2c
SHA256

25477a857ad07267c127356fac71793a1db31dd15450388344d6f2920f0bf28c
SHA512

69aff30c160135b576d047dcab948c5e1aea57093c2f5a56fddad9725f4b1e31ee220ef7dd291a658dd811344142a7779a139eb221bcdec7c133d3249ac9b71c
SSDEEP

12288:FdmfQLtFcRHY1YzTlCxBMRhIkWO23eDpaIOPegl5d6vY6r2cv:jmfotF6W0W/3WpaIOvyw

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{088219E8-85AC-9DFE-7C8C-48C5F5E19AFB}	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Nsaqhrzo.dll	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
File opened for modification	C:\Windows\Nsaqhrzo.ini	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\URLSEARCHHOOKS	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{D269191D-BADD-98A1-93C9-F2A72D0242EE}	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70EDCCA2-08F8-B52D-5018-B11F1DFB2C9D}\InprocServer32	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{088219E8-85AC-9DFE-7C8C-48C5F5E19AFB}	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{088219E8-85AC-9DFE-7C8C-48C5F5E19AFB}\InprocServer32\ThreadingModel = "Apartment"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70EDCCA2-08F8-B52D-5018-B11F1DFB2C9D}	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{088219E8-85AC-9DFE-7C8C-48C5F5E19AFB}\InprocServer32\ = "C:\\Windows\\Nsaqhrzo.dll"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D269191D-BADD-98A1-93C9-F2A72D0242EE}\InprocServer32\ThreadingModel = "Apartment"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70EDCCA2-08F8-B52D-5018-B11F1DFB2C9D}\InprocServer32\ = "C:\\Windows\\Nsaqhrzo.dll"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70EDCCA2-08F8-B52D-5018-B11F1DFB2C9D}\InprocServer32\ThreadingModel = "Apartment"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70EDCCA2-08F8-B52D-5018-B11F1DFB2C9D}\ = "Search"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{088219E8-85AC-9DFE-7C8C-48C5F5E19AFB}\InprocServer32	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D269191D-BADD-98A1-93C9-F2A72D0242EE}\InprocServer32	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D269191D-BADD-98A1-93C9-F2A72D0242EE}	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D269191D-BADD-98A1-93C9-F2A72D0242EE}\InprocServer32\ = "C:\\Windows\\Nsaqhrzo.dll"	5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cc23a5dff34f4b8431e4ce3dd8ed51a_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads