cfc4b5433d74f4d99db3ed7bc9a15fad05292df9ba3343564f7a7a07cc4339b2

General

Target

8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Size

94KB
MD5

8b6f14f32594ae4f9b197dc9fb30c792
SHA1

fa12b61f6f4ced384bebde6e4ab55eeca7906ce8
SHA256

cfc4b5433d74f4d99db3ed7bc9a15fad05292df9ba3343564f7a7a07cc4339b2
SHA512

6d89ab18b63952c9b8d4cbfba637ac7938b193f6a7a6c680c0866c6afac1e9f87d3cf4f823dd1c8df2d9b0fbf1a00463b20685ed9de89d4c84893afe78eb731b
SSDEEP

1536:MxPbpg78UlIlvBvjvQvmaI49tkLSMIRa29EJyoWRUym2gVTzx1826qsk/V19oCQS:OPDvBvjvQvmN8tPMIA29Esn96NiL+V11

Score

7^/10

adware defense_evasion discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4C579E8B-92F1-44d1-9444-66A4355E9386}	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\conf.dat	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rozmchild.dll	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\TypeLib\ = "{A78DE3EE-4D19-4096-81E1-A06B1E862B90}"	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\ = "Google Module"	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\InprocServer32	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\ProgID\ = "RITLAB.1"	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\TypeLib	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\InprocServer32\ = "rozmchild.dll"	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\InprocServer32\ThreadingModel = "Apartment"	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C579E8B-92F1-44d1-9444-66A4355E9386}\ProgID	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2000	1432	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe	84
PID 1432 wrote to memory of 2000	1432	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe	84
PID 1432 wrote to memory of 2000	1432	8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8b6f14f32594ae4f9b197dc9fb30c792_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8B6F14~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000