1735e0042b2690a63ae8f0a9adaafb27f01c987b9204285f998af74ab857b5c2

General

Target

ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Size

52KB
MD5

ea50ecac05788fa48be8642fa67559a6
SHA1

27fb837307cf819f49d81b032433f0efb83defa7
SHA256

1735e0042b2690a63ae8f0a9adaafb27f01c987b9204285f998af74ab857b5c2
SHA512

a7f4fde47a585e9788365d96c47f7d666e6497651023b722ef8fd94c7af1e2951912b5d43377277e45f97e6a138cfd083637736cd000aad35a27157cd7e8bbc6
SSDEEP

768:AOhHYZwo8tATsAgcJEkDavy1ek7MGk9Y1BMYvoxQkdKb3dXNDBB7USf9:l6wouc2fy1J7MGH1SYhvtTBJ

Score

7^/10

adware defense_evasion discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\html32.dll	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dl.dat	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\InprocServer32\ = "html32.dll"	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\ProgID	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\InprocServer32	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\ProgID\ = "RITLAB.1"	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\TypeLib	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\TypeLib\ = "{031E27CA-80DB-40fc-A841-42565F2274B5}"	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\ = "Gamburg provider"	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFFFFFF-28F7-41a7-8D75-7E006D0C15B8}\InprocServer32\ThreadingModel = "Apartment"	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 3064	4332	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe	83
PID 4332 wrote to memory of 3064	4332	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe	83
PID 4332 wrote to memory of 3064	4332	ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea50ecac05788fa48be8642fa67559a6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EA50EC~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064