4be8953694960b8757c4b7930483a1806dd66e0e384ee059893d3148c01f42d0

General

Target

d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
Size

122KB
MD5

d0c13f62a20ad6785e278095702aa14f
SHA1

3a9eedd0ac957e46574d1229f7689fc2974a188a
SHA256

4be8953694960b8757c4b7930483a1806dd66e0e384ee059893d3148c01f42d0
SHA512

5dae312df43735f8701f4b074a0154914a4681aaa1067c1ebfd1cb9db624c424a9bded0a2ad5db0c411a5662e537785f2b1d3e68bf489e84dc424eb7db66579f
SSDEEP

3072:ZsuNh9LoFwT5eot5jySWF3INyySacSls//3SS/tzBVYS0:tXcFwT5eDFmyy9Nl+3x/TVD

Score

7^/10

adware discovery stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000016cfc-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2344	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-0-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/files/0x0009000000016cfc-4.dat	upx
behavioral1/memory/2344-7-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2344-6-0x0000000000220000-0x0000000000264000-memory.dmp	upx
behavioral1/memory/2344-8-0x0000000000220000-0x0000000000264000-memory.dmp	upx
behavioral1/memory/2344-10-0x0000000000220000-0x0000000000264000-memory.dmp	upx
behavioral1/memory/2344-11-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2344-13-0x0000000000220000-0x0000000000264000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27554032-E7FA-4910-B173-30644F544F81}	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27554032-E7FA-4910-B173-30644F544F81}\InprocServer32	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27554032-E7FA-4910-B173-30644F544F81}	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27554032-E7FA-4910-B173-30644F544F81}\InprocServer32\ = "C:\\Windows\\SysWow64\\api-ms-win-security-sddl-l1-1-.dll"	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27554032-E7FA-4910-B173-30644F544F81}\InprocServer32\ThreadingModel = "apartment"	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2344	d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0c13f62a20ad6785e278095702aa14f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\api-ms-win-security-sddl-l1-1-.dll

Filesize
95KB

MD5
2f7981e56b06a9ef9af6553bda11eb2e

SHA1
ce482e518fd981d96c71ffca00a13d20575df679

SHA256
4c053077c984647c495e1da50bb142a6eb407deb0d931577e6437cf2525e9621

SHA512
ae870d866d0317dc78e59d7218e2487765c016560bf8a85f90c7db3da3633e6cce72bec86c78060280dd37721969a2514ba0684879ae524083d293241e28c5e8

Download Submit
memory/2344-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2344-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2344-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2344-6-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download
memory/2344-8-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download
memory/2344-10-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download
memory/2344-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2344-13-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing