7cd572cab2c24f2c54ff847a3b57a0181391eb7f943768ac053bec728a1c0cbd

General

Target

12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Size

22KB
MD5

12d8ed123c466d8906e1114c38fe3bce
SHA1

e42ec30eae44e03af3c9446a672540d5709b83a9
SHA256

7cd572cab2c24f2c54ff847a3b57a0181391eb7f943768ac053bec728a1c0cbd
SHA512

7d1b7ed2e1479b087d8c4c5b5edbb4fd915f26f69c2bd9d16ecfbcf3f10a6fba6c0c06d71fb6fe5abd2b54ebc29198b68eabe55e9d70f3304bdbb7f8467e1bbd
SSDEEP

384:3k2M6MCo79Y51pCf9bsZW27ZJGzWZozD8d9gR1cdOyMaNZwmWIDpfeol56ihEZ2i:3k7RfxY5jCf9beHo6ZuOKvyMaQApfeg1

Score

6^/10

adware discovery stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fdBf32.dll	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\ProgID	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\VersionIndependentProgID	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\TypeLib	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\InprocServer32	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Implemented Categories	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Version	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Programmable	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Token: SeDebugPrivilege	5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
Token: SeDebugPrivilege	5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 608	5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe	5
PID 5744 wrote to memory of 608	5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe	5
PID 5744 wrote to memory of 608	5744	12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608

C:\Users\Admin\AppData\Local\Temp\12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12d8ed123c466d8906e1114c38fe3bce_JaffaCakes118.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4768,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:8
1⤵
PID:2676