Overview

overview

7

Static

static

3

3cbb25f542...18.exe

windows7-x64

7

3cbb25f542...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PROGRAMFI...4_.dll

windows7-x64

3

$PROGRAMFI...4_.dll

windows10-2004-x64

3

$_100_/$_1...5_.dll

windows7-x64

3

$_100_/$_1...5_.dll

windows10-2004-x64

3

$_60_/$_63_.exe

windows7-x64

1

$_60_/$_63_.exe

windows10-2004-x64

3

$_61_.dll

windows7-x64

3

$_61_.dll

windows10-2004-x64

3

$_67_.dll

windows7-x64

3

$_67_.dll

windows10-2004-x64

3

$_76_.dll

windows7-x64

3

$_76_.dll

windows10-2004-x64

3

$_77_.exe

windows7-x64

1

$_77_.exe

windows10-2004-x64

3

uninstall.exe

windows7-x64

1

uninstall.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 00:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3cbb25f5426880ae6db8af8f7582408f_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    3cbb25f5426880ae6db8af8f7582408f

  • SHA1

    f9a8e0ce5453e4d182bdf4c69da2b31f0020bee9

  • SHA256

    b87dc9a0ce9064927bc30b356c7d650de45654c8e54bdc403c3e17bc6f9ef41d

  • SHA512

    1f2e6d63ee087bba13d21b20570939f741b0597bbf83739bc895202fc64321eaf32392db26b9a44d47653f1b1430178c8ea3dce5349321f7610b49985732522c

  • SSDEEP

    49152:XHcqvrDoMJ1l6q8+W2OAQyuTmZkAQzSyguNE401eoNVoUrgoqU:XHcmrDpJWqBLY54uHInVd

Score
7/10
adwarediscoverystealer

Malware Config

Signatures

  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 7 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cbb25f5426880ae6db8af8f7582408f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3cbb25f5426880ae6db8af8f7582408f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://power90.OurToolbar.com/SetupFinish
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:17410 /prefetch:2
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=90266
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=90266
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1136
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd52b46f8,0x7ffcd52b4708,0x7ffcd52b4718
              6⤵
                PID:3928
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9682694203575522773,13548420443750506440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                6⤵
                  PID:1504
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,9682694203575522773,13548420443750506440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2904
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,9682694203575522773,13548420443750506440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                  6⤵
                    PID:4708
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Users\Admin\AppData\LocalLow\power90\tbpowe.dll" DllWriteSocialCookies
                4⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4256
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Users\Admin\AppData\LocalLow\power90\tbpowe.dll" DllWriteSocialCookies
                4⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3164
        • C:\Windows\System32\CompPkgSrv.exe
          C:\Windows\System32\CompPkgSrv.exe -Embedding
          1⤵
            PID:4920
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:4588

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll
              Filesize

              620KB

              MD5

              5c6a15ba23dfb673a81f3c8c38117206

              SHA1

              6817884586147951fda72d82a702f27a4b025b9c

              SHA256

              2be5657bd5d47be35975eabc53b966b82ab31efdf907fea5abf76709b5929e29

              SHA512

              e95c24c7b9955db62c55525cfbcda1c17d3e5c54425a5c7a3bad7641f18b99659a64bff90386edda99e595c7622cb09c684fc2ea2ddc2e0b50ff68ee04f3614a

              Download Submit

            • C:\Program Files (x86)\power90\prxtbpowe.dll
              Filesize

              172KB

              MD5

              4c163bd2a5905d18893ee311608e8c54

              SHA1

              a2d929a9864513c0e8ed84aad622ef6adcc9b950

              SHA256

              4553d99f1f146e2359ceb60987d904bafd24843b71d3e95c358776f3a1d5c6f1

              SHA512

              e1c7b44dc683f58c7c7b66b2448ed19c4e846b35f4018592c2d87191f3d8a2e4649ec3c92aa2f444b249f8ac27e5f2e7fe1cefbedd5d12721d21335a1c55afb1

              Download Submit

            • C:\Program Files (x86)\power90\toolbar.cfg
              Filesize

              19B

              MD5

              bd0bac268fe6b3afd406b17cf2eaf193

              SHA1

              ee8d369fd1a5d12be13816ef168c8fec6cef488e

              SHA256

              b79469d9efb6eeb22cca6e2debfa0231d5eb6b794c04fff46d37d77256aa65f9

              SHA512

              6f451fc73fff7ed49f859df1d9bd44d30ac7ccefd2658cf799d4800887fa531e9d9a22e94dccc3040226355ca8ccd14619be9b1d7b0a80491a6ef185742c7cf9

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
              Filesize

              471B

              MD5

              adca62d83bfe2fccad58a7035e9cb40c

              SHA1

              8585b192deaa613bfbaf08138bc8bbfb0cd09da4

              SHA256

              67026b0a3377b9365d4bcacd1f21b16db8184d256661b7ffab2bf5becf01e343

              SHA512

              b48a0ce890dfc6049206ac43b2d5c5bea57a733cc4e000ff0524c077b6199b3dc2692b1a8d1c1c5e4fb262e0fb2091fdf03040c627fb2bd9bc3e4c46ae2b6074

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
              Filesize

              412B

              MD5

              3db54e8635686f2b7052424aaadb570f

              SHA1

              00700743a900709190d37a208d8ef7630014d440

              SHA256

              ded546d30399f9a063d2ba801f43aa6ff0181fadcb3cfd4fbfb072ccfafdf326

              SHA512

              dade3eba73654ba03a060a27dfa8be3cc262f873b8b23626e2f8990c4e46457f266a520a3f651d522e3cc6440fe958d028c870f76f33020b8b65c8cbbbb70e1f

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\power90\ldrtbpowe.dll
              Filesize

              249KB

              MD5

              f0ac64e1d9a805800578c667283d79a0

              SHA1

              f029155010a8b430019c03c0bbfd1ebefd9e7e28

              SHA256

              884d5f8b03391a9fe9c42424afe810e2263dcbd9fd66447b4fb23da3569b37e2

              SHA512

              e173d55e640a6fbf7df65d392a126e6c9974c9f412e8a4a6b8283949aa8e6374375e03c19bb1e44f75cec4d2bb07fa533caf7f172bd747a1e7ff096c9139347c

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              Filesize

              152B

              MD5

              36988ca14952e1848e81a959880ea217

              SHA1

              a0482ef725657760502c2d1a5abe0bb37aebaadb

              SHA256

              d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

              SHA512

              d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
              Filesize

              6KB

              MD5

              98886ed96b1b88f7c024b8f4b4f68768

              SHA1

              bf627b1e90e8552036a9c36f417d208516174786

              SHA256

              0b76918843053cfe2ebc0c717979e287dd8f9e4cf27ff2a42cf2aac36dbb04c7

              SHA512

              1c2a4f889310478cb22dc0124fcd9a41d5b88ce0ae38a3749564deea4f2b4faf172d5b53cd7ff137d61caba77109b0cd9febf12498ab229224d9dfb2b65c1231

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
              Filesize

              6KB

              MD5

              099371121792b5a82cc758fb03935170

              SHA1

              e120010f028a76c5109bf067ac07cf64c3fa5135

              SHA256

              23f49481456e3d165d8ec9fa7268acc71fc9655c4e75381b5a3368584f8a5bd3

              SHA512

              da745ec9efe7f786bcb15478ec750b6567db67b4d3667f2534797fb91a466729c16dd70f50a052f53b123940758a50bea2d8d5b04c640bf852d3ccd9c93bc82d

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
              Filesize

              6KB

              MD5

              9b1e89ea9bf414e3a0b4f4d19b7c7790

              SHA1

              7c7ae422f8cc1602339a58aaa37a27fb75eb7935

              SHA256

              631728d918c82224b360ec84263eb6250583f2fc71ec9049489258d6bd2b3c4a

              SHA512

              14b471e0409d3cf0b0dadb97a24b18e7bd946cd0b59f39742faf1635701d935f993316a490286ce1297eafdf8f2913d0349e287b40e5c0a6c050077938f8101f

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
              Filesize

              10KB

              MD5

              d2b417e9c7d5c0912f0d5a5b68003634

              SHA1

              1abcb01966956e1fbcca80c5e2c7d162c06c3f11

              SHA256

              3607ed3dbbc82c01d127f11db33e825a06447760949aacc8c9253ed5d87de90b

              SHA512

              3825a3ef98414efff918a913ae222414fa5186751f8e40880938e642084728ad38eb8d158b27a5d0f5cbf86196789b690442d9cc250c5d7542e6f2043873e7e4

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84KCLP1T\v1[1].xml
              Filesize

              742KB

              MD5

              25a40f949855471562a1a9e465cfed7c

              SHA1

              c3a563c56fb8323e6c2ee7fa417c45d8384a4156

              SHA256

              075f1f4ec57dcfdbb2f1b60ffbf9efe0286216c43d0a65f82eae86af66b36127

              SHA512

              e5b4ed8df62488e7bb9ccb77f1daac251f65cd3251257ab94094df1316fa50a96901b32e7e76e47a4616d763ae54d7134f5d29f030ee7d2399bbe728498fedd4

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\suggestions[1].en-US
              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsc98F6.tmp.tbpowe.dll
              Filesize

              4.1MB

              MD5

              3d080a251ecc02c638ede4992ad77374

              SHA1

              67b3ffc3ab18b47995361228ce574477eb8bbd07

              SHA256

              c787f361415e1667d01a28488ac189aa44f534f148c194a289b15b60d8524b7a

              SHA512

              878820eb168b995e4ad2c959cd5d46294a652c6acffb17d32502fcc7b4734293c4fa3deec2957416737e827572206b280aac11d4e2a023bb3173c3eb71288328

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsm98E5.tmp\System.dll
              Filesize

              11KB

              MD5

              959ea64598b9a3e494c00e8fa793be7e

              SHA1

              40f284a3b92c2f04b1038def79579d4b3d066ee0

              SHA256

              03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

              SHA512

              5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\nsm98E5.tmp\nsDialogs.dll
              Filesize

              9KB

              MD5

              f7b92b78f1a00a872c8a38f40afa7d65

              SHA1

              872522498f69ad49270190c74cf3af28862057f2

              SHA256

              2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

              SHA512

              3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79

              Download Submit

            • memory/2648-93-0x00000000049E0000-0x0000000004A80000-memory.dmp

              Filesize

              640KB

              Download

            • memory/2648-74-0x0000000004960000-0x00000000049A2000-memory.dmp

              Filesize

              264KB

              Download

            • memory/2648-55-0x00000000048D0000-0x00000000048FF000-memory.dmp

              Filesize

              188KB

              Download

            • memory/2648-34-0x0000000005010000-0x000000000542C000-memory.dmp

              Filesize

              4.1MB

              Download

            • memory/2648-82-0x0000000005660000-0x0000000005A7C000-memory.dmp

              Filesize

              4.1MB

              Download