9bd43a222f7d5c6cc00c27ddf895c06326405e0c4767dce7b0ccbbb0e7ed419d

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
Size

395KB
MD5

28053b06c70dd188377675b4380d3e7a
SHA1

5c129896a319dd3dc75469dcf4ae314708c60933
SHA256

9bd43a222f7d5c6cc00c27ddf895c06326405e0c4767dce7b0ccbbb0e7ed419d
SHA512

ff34d98ece181a7304fa1637d8da604ed674a6c0988077a7f7b9f5afb79897f703355092c5aa88364750ccdba81a20dfa78b732390a47700ea03be2867c63185
SSDEEP

6144:5wddenLgIFiTzRKgvLNTCP1HOQOVc68ch+DF4pVkul0YGP219geVi+sXqxl9In1T:2eXkDLNTC5mV524PBSP21SeQvq9Xfe

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 27 IoCs

pid	Process
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
2404	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}\NoExplorer = "\"\""	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cont_mxlivemedia-remove.exe	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\nso9F8D.tmp	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nso9F8D.dll	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}\InProcServer32	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}\InProcServer32\ = "C:\\Windows\\SysWow64\\nso9F8D.dll"	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}\InProcServer32\ThreadingModel = "Apartment"	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e5557d1-83e2-dbaa-5477-4ad2a398ac67}\ = "mxlivemedia"	28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28053b06c70dd188377675b4380d3e7a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nso9F8D.dll

Filesize
542KB

MD5
5e76064bb7b2cfac6af402096ce87b54

SHA1
27631e24933206ee99fcee7749ce3aae39bc9c21

SHA256
42c4f2cec1a485b19359046ff43cef627049aa7290a641f3b0539aa7b917960b

SHA512
b3df141ec8be29e4bf13cd1f733a52d07eaf5f1716b32585877c1db28759831f6471e55b65ef1f83fe5bd070739bf4b1c272edb05546845bc53dcbdb0405b3e3

Download Submit
\Users\Admin\AppData\Local\Temp\nsj9F1F.tmp\NSISdl.dll

Filesize
14KB

MD5
f0e51d5722c11a4fe40c97b746c1ffc5

SHA1
8ec31853e9ef08fdc2a8c3c8eaa5f5b9469af193

SHA256
93a27f96055ae6b7f44916e13487b0efa7cd6d762e6768f7cb6427e32bda777d

SHA512
212c1ed753b54e5eccf7e1421bcca86955e09d6e3873f891d3d7076e21f79feb5f1dba350818804a215980875c306283b02f628fbc191d958f0de0f528c7194a

Download Submit
\Users\Admin\AppData\Local\Temp\nsj9F1F.tmp\System.dll

Filesize
10KB

MD5
7e3c808299aa2c405dffa864471ddb7f

SHA1
b5de7804dd35ed7afd0c3b59d866f1a0749495e0

SHA256
91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd

SHA512
599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738

Download Submit
memory/2404-95-0x0000000002860000-0x00000000028EE000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads