4323506e23c9301f8f0df5ec8d0048061f7b980144072135a2f48980f27d2e95

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
Size

240KB
MD5

ab68662b2ad1002d1d7942f376e1d00d
SHA1

00a309dc04ec808161f62b7a71130bcac16049f9
SHA256

4323506e23c9301f8f0df5ec8d0048061f7b980144072135a2f48980f27d2e95
SHA512

8942137ed7e077b8d5f674efc0df850d625fd5f42826eddfd1d2b1e9209573179c49d6eb8b62ea3cdf34f78eae7dcf487f4c8f46841fd5e1be315c456f33c9e7
SSDEEP

6144:OveNULnQOyqZ9Gd64VyyTBFoDp6nPecQXl:O2NUT7yCAdXhBuDUmf

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2848	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kdpini.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vumer.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ppobo.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ssa.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kuser.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mukmil.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lastmon.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\4448c9ae16b95ec1ee78442857f63f4e.gif	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kwpm.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lastmon.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gln.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ire852.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spria.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cunta.dll	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab68662b2ad1002d1d7942f376e1d00d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\lastmon.dll

Filesize
188KB

MD5
495386904b693c7868c8a31ee908fd66

SHA1
3aa368e653c924438c8931f420ed60b48f5277e0

SHA256
f20b61d57fd387ffb66387eb6f47ebce1a141d9e010127220ceed4a4cf8d49c0

SHA512
e578dc90b1f120196aba6a18d07f416b03a59efe3c08a54ba63b9d9a1300fd4dedb80fe9cfa4cd6379d6c342e899ba3b60bd51693fcf9c687743128b3aa9ad0a

Download Submit