6d1680b37cb4a90bf1fa684789b845bfb93a0da30394d867dbe1fd4009bb5b6c

General

Target
jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Size 117KB
Sample261009-ymdp8svs8j
SHA256 6d1680b37cb4a90bf1fa684789b845bfb93a0da30394d867dbe1fd4009bb5b6c
MD5 2121e7cd658f40f349020f5dafbaf442
SHA1 c0a767257004294e198e37faa80ec42128c74382
SHA512 5b39eacf8b97df2fbb12b47d46d83d68af5803e10cdeaae37629ed39767c270635c043bb977683ec7a2baa184941226804c95300e7402564147e8036c7cc0cc3
SSDEEP 3072:mYyeuXUefPo6pg+potGrqksjI1GwAS6k0AzkkQVXVwqzbI7XV6:BuEe8+potGruYGRSHfQFFzbUF
TLSH
T146C31288B7D2FE9FDCF925F11735F95AB618AD056AC1B2924CA2136724FA411C733831
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
252	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\ = "GoogleMS Search Helper"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/252-0-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/252-6-0x0000000000400000-0x0000000000448000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp.1\CLSID\ = "{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp\CLSID	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\ProgID\ = "GoogleMS.SearchHelp.1"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\VersionIndependentProgID	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\VersionIndependentProgID\ = "GoogleMS.SearchHelp"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\TypeLib\ = "{355F8396-C845-4966-A103-8A05D0004248}"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp.1\CLSID	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp\CurVer\ = "GoogleMS.SearchHelp.1"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\ = "SearchHelp Class"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\InprocServer32\ThreadingModel = "Apartment"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp\CLSID\ = "{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\InprocServer32	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleMS.dll"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\TypeLib	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\ProgID	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp.1	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp.1\ = "SearchHelp Class"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp\ = "SearchHelp Class"	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleMS.SearchHelp\CurVer	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79369D5C-2903-4b7a-ADE2-D5E0DEE14D24}\Programmable	jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.dk.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleMS.dll

Path C:\Users\Admin\AppData\Roaming\GoogleMS.dll
Size 232KB
SHA256 c5a9a56bb88a344f69ee6a049794d511da7dc7fd2607ab433c621648fbc59eae
MD5 8acbe179773eb5c5f32f168ba9b309a3
SHA1 f5e48f6fb5d87b79aa0acd09e1b844a1a90c79f3
SHA512 71ee0a5663431f4ca2d06dea5dc2637f5ab249097dfff4997065e467a4181036e5d4216c9730e7f8ed4d758514d778af8a339269e0bf2ee28497d530293ee4cd
SSDEEP 3072:USNiKjOzkRk3ZhmxvZimyc0iCCPcJtfgnq2blmjDPz0xBCVA8IC8A9VvEb8bwF:1iNnshzL0bCCtfSTlYn+aICBvEGwF
TLSH
T1D3348E033695C17DC2BF26BB8E4A97A9B3F6D9104BB0D14377E18E9C0E3D94B4935A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-0-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/252-6-0x0000000000400000-0x0000000000448000-memory.dmp