e9dfbd40f23115cd73a92aa2a01394d4a599aa2b259e3e99c8f2144772032296

Analysis

max time kernel
96s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Size

209KB
MD5

397d1aee0beef7a73516b6aa30bcf26b
SHA1

d8d08b8982fdd64a29a772f6713bcdde99e9da07
SHA256

e9dfbd40f23115cd73a92aa2a01394d4a599aa2b259e3e99c8f2144772032296
SHA512

02795a79aabc8641faa5f57182fe8dec2479332e175c4233b090a0e5095d15b7b09fcbd8c6a843afe8516be633cf52482446b3a9ba26591c92b7a3f5179a87aa
SSDEEP

3072:ILk395hYXJm1ZpGjnC7l+QRmLQUr6/Yd3cOoavqh7lEOcf08:IQq41ZpiCrsLQrYxcOfo27

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
4504	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
4504	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
4504	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
4504	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
4504	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
4504	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\ = "FaceCons"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\NoExplorer = "1"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Facecons\onload.js	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Facecons\uninstall.exe	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Facecons\Facecons.dll	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Facecons\facecons.crx	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\Program Files (x86)\\Facecons\\facecons.dll"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IFaceconsEBHO"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS\CurVer\ = "FaceCons.FACECONS.1"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\ = "FACECONS Class"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IFaceconsEBHO"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS.1\CLSID\ = "{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C2178B36-2955-479B-818C-A2AE8E500454}	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\ProgID	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\VersionIndependentProgID	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\Programmable	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Facecons"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS.1\CLSID	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS\CurVer	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\ProgID\ = "FaceCons.FACECONS.1"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS.1	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Facecons.DLL	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS\CLSID\ = "{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\InprocServer32\ = "C:\\Program Files (x86)\\Facecons\\facecons.dll"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C2178B36-2955-479B-818C-A2AE8E500454}\ = "Facecons"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS.1\ = "FACECONS Class"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS\ = "FACECONS Class"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaceCons.FACECONS\CLSID	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\InprocServer32	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\InprocServer32\ThreadingModel = "Apartment"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\TypeLib	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Facecons.DLL\AppID = "{C2178B36-2955-479B-818C-A2AE8E500454}"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Facecons 1.0 Type Library"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2A44031-7EAD-434C-AC9E-7F1DA176BA8C}\VersionIndependentProgID\ = "FaceCons.FACECONS"	397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\397d1aee0beef7a73516b6aa30bcf26b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Facecons\Facecons.dll

Filesize
163KB

MD5
903c44df963e8eae60a0d867c12e686a

SHA1
403fa344492ca81c9499b91673e56c7b159d319f

SHA256
2499f723ac4974fdb6d7e1349888710a3fdf31f8437c30609675ddaf4bf8c341

SHA512
f456825ba171ca9281046040bd2bcd9bc06b5dbaf171d43b23bbd181c35146f83cb7e5004f736a8dd215fb4c5300b3152061341ddb12027440d6937a2eb58321

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvBA0A.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvBA0A.tmp\inetc.dll

Filesize
20KB

MD5
9a7d35d1e9e5dfb6a7872d49cf64db83

SHA1
4da9dd5427c0fdfa2cce3ee29ac5147b74ff3834

SHA256
c7a365c50611e7b3bbec6f73e9b33fa83d9ca91c34cde67969cd7cab79293160

SHA512
cb98bc94b883ecd88102a017de484560085c0f70fa379489618cc10c017d543e53b12502a0a7cae49682887676c4c590fc481ab9cd531467b1d090499783db3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvBA0A.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit