Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 10:14
Behavioral task
behavioral1
Sample
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe
-
Size
6KB
-
MD5
1ae715b525231af3e4bef627133e4a7e
-
SHA1
3c1c61eec19010207c89bb90b907e2c4c2f6634c
-
SHA256
4d3b63992f1d1fac3f849875d55e0af40f3b0a330ea2e86b73f061e476882f09
-
SHA512
61f989df563fe922be4fe8022a3974c28f668ae868693c78ba20699eacb0c7e846d5752158a2718c85752730a9e9477111b8b147ca0bb51dbcad25e300eab532
-
SSDEEP
96:vBiWRtU5SOlkhbZtjgLqM/EcohGOePWCHEKWr:vQWfWlkhZtcdEcohJoWCkKWr
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3360-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3360-1-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056} 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\ = "ASP Helper" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe -
Processes:
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe -
Modifies registry class 6 IoCs
Processes:
1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056} 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\InProcServer32\ = "C:\\Windows\\system\\bpimts32.dll" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\InProcServer32\ThreadingModel = "Apartment" 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FB51D0-79AE-A3FC-B6D6-0B221BC55056}\InProcServer32 1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ae715b525231af3e4bef627133e4a7e_JaffaCakes118.exe"1⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1304,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:81⤵