3f7a65865bb2fbfb2a3ecaad52c8563ed1c3379c73b5a4503cc1f8520458e877

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9da6893d98f4eafb1b42d0e0d941a21_JaffaCakes118.dll
Size 86KB
Sample240409-m9e12ade43
SHA256 3f7a65865bb2fbfb2a3ecaad52c8563ed1c3379c73b5a4503cc1f8520458e877
MD5 e9da6893d98f4eafb1b42d0e0d941a21
SHA1 1278a3ecc7e17996fc0d42359c8d6326cf9cc08f
SHA512 2cc4c5828782f65a1012c7dceb9fd45e8fa301ded6cf4513ac7085dca5578b915ee02b476ed45ff66a8f2f608a88458261ec4c40a9c2e8f8149173c35d9de23d
SSDEEP 1536:AYvynn+A2VKzu2z/wxy81NjfC1HDGddFa2JT3ziSt48roLgfFZt9Q/vvmNgr3+:Nv4+A9zTjf81RC1HDDGzLm7efk3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3348-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7BC3B54B-0611-4755-9837-3613A245EC57}	regsvr32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BC3B54B-0611-4755-9837-3613A245EC57}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BC3B54B-0611-4755-9837-3613A245EC57}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BC3B54B-0611-4755-9837-3613A245EC57}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BC3B54B-0611-4755-9837-3613A245EC57}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e9da6893d98f4eafb1b42d0e0d941a21_JaffaCakes118.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3348	2440	regsvr32.exe	86
PID 2440 wrote to memory of 3348	2440	regsvr32.exe	86
PID 2440 wrote to memory of 3348	2440	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e9da6893d98f4eafb1b42d0e0d941a21_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e9da6893d98f4eafb1b42d0e0d941a21_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download