606916b274b494af604f242e43117c416015ef5d3d551925470329623044ea40

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.dll
Size

562KB
MD5

1a507ed7b11d7c4412c2a54237c448e5
SHA1

099eb1a9ed37018e1d5399543e341fd288014be6
SHA256

606916b274b494af604f242e43117c416015ef5d3d551925470329623044ea40
SHA512

a88357b18b7eb8102ccd0900c625ded889466cc072f750d34c38190ee039b4f025441dbe7a0963ebe808f15cf1860994678c7d8a90489340779fa2e173d8a98c
SSDEEP

12288:4gUV94y09yxH1az44i2JiU5VVNIUOZH5bM2QPTjG:UVGy0E04wskIZHGnPTj

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Processes:

regsvr32.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36} regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}	regsvr32.exe

Modifies registry class 11 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.ic\ = "ic"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.ic	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.ic\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.ic\Clsid\ = "{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}\ProgID\ = "1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.ic"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-D893-BD17-28B5-2FC8E2158E36}\ = "ic"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe
PID 2736 wrote to memory of 2236	2736	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1a507ed7b11d7c4412c2a54237c448e5_JaffaCakes118.dll
2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2236

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000000A00000-0x0000000000A91000-memory.dmp

Filesize
580KB

Download