bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96

Analysis

max time kernel
95s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2025, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
Size 353KB
Sample250121-vlsafstrgl
SHA256 bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96
MD5 0626220c6b36b91ef947bfadb5ffc3b4
SHA1 3d90a5f553480b4e27aecb1529a0f355e1304615
SHA512 fe4ebbe0f4111ed569f64be4c57d6bd2345f853973ec8f1191a5d15de5fae85a43b38bdf53a0369414672c5e8320721605bbc3efb466aba78010837f0bf2ef0e
SSDEEP 6144:WX7eov9mh+35YitVNuwGwKl+/97/x0jG4nO8NZHATQW+F6YYN+onLYcyz:4Ah+35Yit8vUF7/xN4N/Az+4v6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 16 IoCs

pid	Process
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
3920	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}\NoExplorer = "\"\""	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nscB25B.dll	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
File created	C:\Windows\SysWOW64\cont_milehighads-remove.exe	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
File opened for modification	C:\Windows\SysWOW64\nscB25B.tmp	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}\ = "milehighads"	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}\InProcServer32	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}\InProcServer32\ = "C:\\Windows\\SysWow64\\nscB25B.dll"	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f6c577a8-6e99-1f7f-1dad-22f8bf7b1aab}\InProcServer32\ThreadingModel = "Apartment"	JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nssB21C.tmp\NSISdl.dll
Size 14KB
SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
MD5 997ae296af5b7ca9aaa52f6844075439
SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nssB21C.tmp\System.dll
Size 10KB
SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
MD5 32465a07028b927b22c38e642c2cb836
SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

nscB25B.dll

Path C:\Windows\SysWOW64\nscB25B.dll
Size 356KB
SHA256 9c365454cdb24ca83cda0667f75ab32dff1b0abf8bb5861f83ad8c73ead7b7d7
MD5 3b758b989821e5ca2b73033707430ccb
SHA1 f4563245e38e5c746f9cc0ea7b1f1a38c7113b2b
SHA512 f113ff7403b7305c6686f3d57d3c9e66262f29593c385de387d5258bcdebda323c8e4eacb79542c0db87952c6dc957754e30f16ee565404144c952fb755fc732
SSDEEP 6144:p8Z3s9FSZkn2VT7aMKGvOIYnGrR+h+7eeMTTBkkRnRazS0RTgbpJRICa:ps3ak7DfnrR+yYTTekRnR5WgNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3920-53-0x0000000003000000-0x000000000305E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads