d55da147d54f001f69174db881fdc3ddb83a7173f87b8f960b8ca0a81dcabc51

General

Target

70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Size

393KB
MD5

70ee3ae684fffd7e17e4f36519da8586
SHA1

463e9e19ab96fc96e07f529ce387dfab1f31b2d1
SHA256

d55da147d54f001f69174db881fdc3ddb83a7173f87b8f960b8ca0a81dcabc51
SHA512

1365ab4c22bb762a9200f544c319c9bf6aa1f700515aea4dc4c47f25c773367528626f3a5504027490b097182de555037e6fe8f056ae761bec0e645ea7f5c430
SSDEEP

12288:jykIYw25B7PaBYiStKSDSk7dKj8n4OwT63:bIE3CgKS1b4DTS

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3832	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
3832	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
3832	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}\NoExplorer = "1"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\u_zhcglsttkwxqpux.dll.exe	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zhcglsttkwxqpux.dll	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}\ = "seekgadget search enhancer"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}\InProcServer32\ = "C:\\Windows\\SysWow64\\zhcglsttkwxqpux.dll"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\ = "Search panel"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\InProcServer32\ThreadingModel = "Apartment"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\Programmable	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\InProcServer32	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\Implemented Categories\{00021493-0000-0000-C000-000000000046}	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\InProcServer32\ = "C:\\Windows\\SysWow64\\zhcglsttkwxqpux.dll"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}\InProcServer32	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37B0377F-7A0A-DDA6-C5D1-B65E71D02391}\InProcServer32\ThreadingModel = "Apartment"	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9131B9B1-D48F-91F2-2259-D2D77BBB7BC5}\Implemented Categories	70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70ee3ae684fffd7e17e4f36519da8586_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsmD727.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Windows\SysWOW64\zhcglsttkwxqpux.dll

Filesize
384KB

MD5
9d3bac3ea78e7c59a0f46d9d28a32fbf

SHA1
876e4eaae9a6089501e0f9376f6f5c5736a45d82

SHA256
9dcd339f85e966a4e5ffb8c111e3755b4cd675016da8b8de0215df08950ffbb7

SHA512
49285eee49af338c296d4f1455a371638400a4870ceb4ec5c502cbe224b6f7b0e246cea2e62b23ffb97cbbb855f2e54b109aa6d93d3dd2da31bbd37f172aac84

Download Submit
memory/3832-9-0x0000000002A90000-0x0000000002AF8000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads