Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3f03de4eb3f...18.exe
windows7-x64
7f03de4eb3f...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3chrome/con...nts.js
windows7-x64
3chrome/con...nts.js
windows10-2004-x64
3chrome/con...ion.js
windows7-x64
3chrome/con...ion.js
windows10-2004-x64
3chrome/con...sts.js
windows7-x64
3chrome/con...sts.js
windows10-2004-x64
3chrome/con...ics.js
windows7-x64
3chrome/con...ics.js
windows10-2004-x64
3chrome/con...min.js
windows7-x64
3chrome/con...min.js
windows10-2004-x64
3chrome/con...ain.js
windows7-x64
3chrome/con...ain.js
windows10-2004-x64
3chrome/con...est.js
windows7-x64
3chrome/con...est.js
windows10-2004-x64
3chrome/con...ipt.js
windows7-x64
3chrome/con...ipt.js
windows10-2004-x64
3chrome/con...ats.js
windows7-x64
3chrome/con...ats.js
windows10-2004-x64
3chrome/con...age.js
windows7-x64
3chrome/con...age.js
windows10-2004-x64
3appprepend.js
windows7-x64
3appprepend.js
windows10-2004-x64
3background.html
windows7-x64
3background.html
windows10-2004-x64
3Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
chrome/content/browserevents.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
chrome/content/browserevents.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
chrome/content/configuration.js
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
chrome/content/configuration.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
chrome/content/consts.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
chrome/content/consts.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
chrome/content/diagnostics.js
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
chrome/content/diagnostics.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
chrome/content/jquery-1.4.4.min.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
chrome/content/jquery-1.4.4.min.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
chrome/content/main.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
chrome/content/main.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
chrome/content/request.js
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
chrome/content/request.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
chrome/content/script.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
chrome/content/script.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
chrome/content/stats.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
chrome/content/stats.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
chrome/content/storage.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
chrome/content/storage.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
appprepend.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
appprepend.js
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
background.html
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral32
Sample
background.html
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe
-
Size
439KB
-
MD5
f03de4eb3fe357252988d27cfdfcea8a
-
SHA1
de6c1e6602dd6fa8ae3838b3bb945c5dd14fe76d
-
SHA256
37a9e383f3c4374c2d1d93036e5fb14fc8e18112a888580d2165c0619b3f4a0d
-
SHA512
68a651543d6a1adb76ddd54e7e6a5047b94c6666e848f56ead880a142b2401c4505cc10b12e4de08d0cfd3c1a626f5a949b9a1d8b10a76eeac7f27d294815f08
-
SSDEEP
12288:6xBrte102j3bdINgI/RMqIzyZlHNdJtdPQ5meaqC54:67r2hQp/DOy35tdP3exCy
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe 904 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\PricePeep\installer.ico f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe File created C:\Program Files (x86)\PricePeep\pricepeep.crx f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe File created C:\Program Files (x86)\PricePeep\pricepeep.dll f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe File created C:\Program Files (x86)\PricePeep\uninstall.exe f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\Programmable f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL\AppID = "{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\ = "PricePeep 1.0 Type Library" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}\ = "PricePeep" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ThreadingModel = "Apartment" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID\ = "PricePeep.PricePeepBho.1" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS\ = "0" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID\ = "PricePeep.PricePeepBho" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PricePeep" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32 f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8} f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\ = "PricePeep" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\ = "PricePeep" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer\ = "PricePeep.PricePeepBho.1" f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f03de4eb3fe357252988d27cfdfcea8a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
MD5f819dbda954138c942d2432e6194770c
SHA155a9b245b5e0589f995aad5b3107b3442c6132b4
SHA256a7f29436b45c6901ecaab7437389736ab48117e8a3685c3d7642feb4b1860eab
SHA512152a337e80ae20a81af2486b556cc055b97e829d436d11ee28f23ae2fee48d66e974fcf43016590929e6e9393b1ed7e5123fc66e86e143d98132895beee46bbf
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
17KB
MD588ad3fd90fc52ac3ee0441a38400a384
SHA108bc9e1f5951b54126b5c3c769e3eaed42f3d10b
SHA256e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
SHA512359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
-
Filesize
20KB
MD54c01fdfd2b57b32046b3b3635a4f4df8
SHA1e0af8e418cbe2b2783b5de93279a3b5dcb73490e
SHA256b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014
SHA512cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2