96b1004f016ad4da13b2b3f617c93dca4bce1f9ba5d46732c4cd3cd51f45a036

General

Target

0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Size

96KB
MD5

0921b4b91914d5b8a8c32ff7b4f89e4e
SHA1

07aa0a354e4efb6f6ee8726dc4fe2e3f2d1a7ba2
SHA256

96b1004f016ad4da13b2b3f617c93dca4bce1f9ba5d46732c4cd3cd51f45a036
SHA512

b7ab6dc60c0bfdb07714ae0a70a44749f51d27413b1375255f205f6c2a4f6296f6b47b270ddd6bcaa4bd8a8e02fa9e2c6d804f97379b2956ddde7b99fda1e05e
SSDEEP

3072:RtJSttMbvFNK5bRX8zirjWuGLshxt7jBLZTt:jJSttEvF4bEEGLOtBF5

Score

7^/10

adware discovery persistence stealer upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4508	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
4452	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iwohaxi.dll = "C:\\Windows\\system32\\rundll32.exe C:\\Windows\\system32\\iwohaxi.dll,zzdkluf"	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06EE6C8E-48A9-27A2-D0F5-04E9543260E1}	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\usvsotg.dll	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\iwohaxi.dll	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/4508-12-0x0000000000400000-0x000000000042E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EE6C8E-48A9-27A2-D0F5-04E9543260E1}	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EE6C8E-48A9-27A2-D0F5-04E9543260E1}\InprocServer32\ = "C:\\Windows\\SysWow64\\usvsotg.dll"	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EE6C8E-48A9-27A2-D0F5-04E9543260E1}\InprocServer32\ThreadingModel = "Apartment"	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06EE6C8E-48A9-27A2-D0F5-04E9543260E1}\InprocServer32	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
4508	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4452	4508	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe	89
PID 4508 wrote to memory of 4452	4508	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe	89
PID 4508 wrote to memory of 4452	4508	0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0921b4b91914d5b8a8c32ff7b4f89e4e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\iwohaxi.dll,zzdkluf
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1012,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\iwohaxi.dll

Filesize
84KB

MD5
fd9c549a54ced1e36265d212e88d22a1

SHA1
444d7c67e2fbea5d1f493dc3df24f44a4ef80699

SHA256
a8528dbdc7a81e1f8d08b82617bd47d93f3bd52d6a80d32dd155fe3e82f86655

SHA512
a38682b79ff1073d3461f271b29ccae22dfc1e4e55832a8d5d0dfaa0b43a2f83361fb137c443188f1f4e5f741ef7b41b03cdbe24eaa07cd9b5990c23c0282c22

Download Submit
C:\Windows\SysWOW64\usvsotg.dll

Filesize
62KB

MD5
c5601c51beb9995beeb0e13812cba088

SHA1
5922641ddedd80dd0757c34c22393b7328da8a68

SHA256
34ac695642362a8dfbcc718a7ad90f33781d4e45722e85fa59062df035a78655

SHA512
531912985b7dadae45e0bd2934b6ba98990970b326b8c6f19af993784a871230bc9a146ca2f1e26b6725a272d68635cfdd2855a7cd94eb713078998b61154b82

Download Submit
memory/4452-9-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4452-11-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4508-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4508-6-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/4508-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4508-13-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/4508-20-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads