Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:14
Behavioral task
behavioral1
Sample
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe
-
Size
6KB
-
MD5
1ae715b525231af3e4bef627133e4a7e
-
SHA1
3c1c61eec19010207c89bb90b907e2c4c2f6634c
-
SHA256
4d3b63992f1d1fac3f849875d55e0af40f3b0a330ea2e86b73f061e476882f09
-
SHA512
61f989df563fe922be4fe8022a3974c28f668ae868693c78ba20699eacb0c7e846d5752158a2718c85752730a9e9477111b8b147ca0bb51dbcad25e300eab532
-
SSDEEP
96:vBiWRtU5SOlkhbZtjgLqM/EcohGOePWCHEKWr:vQWfWlkhZtcdEcohJoWCkKWr
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1648-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1648-2-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056} 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\ = "ASP Helper" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe -
Processes:
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe -
Modifies registry class 6 IoCs
Processes:
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\InProcServer32 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056} 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\InProcServer32\ = "C:\\Windows\\system\\bpimts32.dll" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\InProcServer32\ThreadingModel = "Apartment" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe