2ef3d86fed62cdb7aa1f7134fab508bc1fbf34686ccf1220c80911462c5b80bf

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
Size

2.8MB
MD5

fe7f67e9a26c42e1bac3cddb8fd2e108
SHA1

4484cd66f3aa4db750c9cf70b53044a14993c42f
SHA256

2ef3d86fed62cdb7aa1f7134fab508bc1fbf34686ccf1220c80911462c5b80bf
SHA512

30fd85cb6b8ddff53f203843d7fa687d8ac336441cfcdcac712f755e6cd2986d5e7f44904ef4169e13f240bf4575124d5b97d914c3300a53e753884998b6a7e7
SSDEEP

49152:JI8+0aT+Fn/fwSVz2Uwlro7yDrVDOgz+FiMLIa+9PR1BqHMpqwq/EQEbqWRYWqVg:Jh+sn3T1wpo7yPVDOdAE1KPR1By8qwqX

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4016	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}\NoExplorer = "1"	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ce3e0926.dll	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\873e5b65.exe	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\873e5b65.exe	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}\InProcServer32\ = "C:\\Windows\\SysWow64\\ce3e0926.dll"	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}\InProcServer32\ThreadingModel = "Apartment"	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}\ = "internetspooler"	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06f299e1-a934-ccd7-4c78-1b4a1ff7c004}\InProcServer32	fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe7f67e9a26c42e1bac3cddb8fd2e108_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ce3e0926.dll

Filesize
3.0MB

MD5
4f36dcf29ef3110a57dbbedd66909576

SHA1
24497558375941821cdea8329b375a63d9dbb329

SHA256
91a57c2c039ba7920333b42b35419de974ce244d5509dc749218526e85f70e47

SHA512
eee903a4d3ebe988114ebe5d873711f8ad824c82e9be89c9daf613c6cb8f90a887f18b5a2ad16ab295cea95b21cdfe5097ac20188dcf858a1c9e0855d520ef8d

Download Submit