e266f8fd8ec47f9a90a8e3a7b1bea5f7aca88671cd6011d7291817bd89a5c328

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe
Size

38KB
MD5

b07359a240efa7330b6bdae8774e4914
SHA1

e1a8aa0aa5d21c5db8fc53cb31d734edc3afc77d
SHA256

e266f8fd8ec47f9a90a8e3a7b1bea5f7aca88671cd6011d7291817bd89a5c328
SHA512

d2bdc15ae9d04c6c1de3f24a8b31a03515a5b6f4e268ff4e4846552fc92bc3550147cc43d20ed1f3feec6b074c177a65c91528ab31e6226094f79e05cecd4372
SSDEEP

768:3do22GxAeAF9lV/CGbiY/fCURrBX6TnbR0eCHmH2br:3dt2CApzlRGYyUR3u2/

Score

6^/10

adware discovery stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}	b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InProcServer32\ = "C:\\Windows\\iexplorer.dll"	b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InProcServer32\ThreadingModel = "Apartment"	b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}	b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\InProcServer32	b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b07359a240efa7330b6bdae8774e4914_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2296-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2296-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download