191aaba11e8602843a099878c617ce9765303ffe1154ce557f55b367e062470e

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.dll
Size

610KB
MD5

1b194a6656331956b09c74cbbe567bb4
SHA1

a66b3c582c8f67ac74224ddc28c3fa3ca59459d2
SHA256

191aaba11e8602843a099878c617ce9765303ffe1154ce557f55b367e062470e
SHA512

b1c03d27136ac36136276854879eda50e2bc40e5058b694bbc8d06a66d5c7c38a4e5d3bfbe2f76663bbf0df64f340c98c4565437ae91e7be5ae137a2d58ce8c6
SSDEEP

12288:pyA1ZdqVfv/6HftOIA3+00wstpSdCi3TLdLOGnF3sD6VBwB6HeIBv7pj:51fqZCHwIr00taCiHpztO6USeIBT

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Processes:

regsvr32.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84} regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}	regsvr32.exe

Modifies registry class 11 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}\ProgID\ = "1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.sb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.sb	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.sb\ = "sb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.sb\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.sb\Clsid\ = "{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}\ = "sb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-6F9D-88AD-4196-A22E5B3D4D84}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 212 wrote to memory of 4188	212	regsvr32.exe	regsvr32.exe
PID 212 wrote to memory of 4188	212	regsvr32.exe	regsvr32.exe
PID 212 wrote to memory of 4188	212	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1b194a6656331956b09c74cbbe567bb4_JaffaCakes118.dll
2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:4872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4188-0-0x0000000000A00000-0x0000000000A9E000-memory.dmp

Filesize
632KB

Download