e4c44b88384000e45b9a2c95a56c0e3c05e684388ea6962b0d069e4ef270d159

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe
Size

318KB
MD5

1a8ee5fcdef73c30d974e42b7701a1e8
SHA1

2ea6a8ed34cdc2651df6f312b9068f3992179169
SHA256

e4c44b88384000e45b9a2c95a56c0e3c05e684388ea6962b0d069e4ef270d159
SHA512

d37ded3a4c7945076e423d802c1b7cbc77a1a9fed45a8ad963a4f82824c88f1ac598fee20d56882a2570ae198b90ca5263b358ffd47b128cf618ab3480f17f9a
SSDEEP

6144:DAwcb7+OtSuCKXh/jnUvOhNdx+P/5S0+aUge:DAwTOwmjtqpsaxe

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\d = "C:\\Program Files (x86)\\Internet Explorer\\ctfmonccw.exe"	regsvr32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3800 regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe

pid	process
3800	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2831909-0672-390B-8AB3-3A041B9528E5}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2831909-0672-390B-8AB3-3A041B9528E5}\IExplore = "1"	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe

description ioc process

File created C:\Windows\SysWOW64\wz25925.dll 1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe
Drops file in Program Files directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created C:\Program Files (x86)\Internet Explorer\ctfmonccw.exe regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\SysWOW64\wz25925.dll	1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\ctfmonccw.exe	regsvr32.exe

Modifies registry class 41 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\ProgID\ = "D.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\ = "IDOMPeek"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\ = "D"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\ = "LIB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\TypeLib\ = "{66792013-5933-3DEC-B011-9A0F275C3A97}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\TypeLib\ = "{66792013-5933-3DEC-B011-9A0F275C3A97}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\VersionIndependentProgID\ = "D"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\InprocServer32\ = "C:\\Windows\\SysWow64\\wz25925.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\wz25925.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66792013-5933-3DEC-B011-9A0F275C3A97}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\ = "IDOMPeek"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7811CD3F-E431-3663-8E43-DF402E073E22}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{D2831909-0672-390B-8AB3-3A041B9528E5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{D2831909-0672-390B-8AB3-3A041B9528E5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2831909-0672-390B-8AB3-3A041B9528E5}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe

description	pid	process	target process
PID 2904 wrote to memory of 3800	2904	1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe	regsvr32.exe
PID 2904 wrote to memory of 3800	2904	1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe	regsvr32.exe
PID 2904 wrote to memory of 3800	2904	1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a8ee5fcdef73c30d974e42b7701a1e8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\wz25925.dll
2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:3800

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wz25925.dll
Filesize
252KB

MD5
12fdac57640eb1e382af8dd045630d5d

SHA1
04e65be250d4120ec5515118273cdd4b860e9d54

SHA256
81d1a802ac418993649f53618ae200fefe99d47000973db754cff73c2bf02d51

SHA512
ae08276ee4ea7fe19de39f8f284e741e2ed121e4a5c27caec647223dbc8bd2f03f2cff62b609075a3e8885b0e00c22a0e9ce9dca6f221d8d3016682c76bbb575

Download Submit