17db48cf1423c7c4e1bb264d256f81f3c65cba1dfc5675db81cfae82e69b6710

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe
Size 18KB
Sample240411-krshasbb8s
SHA256 17db48cf1423c7c4e1bb264d256f81f3c65cba1dfc5675db81cfae82e69b6710
MD5 ed08543a98223e4abf43b8182346af9b
SHA1 905de441774634cd02f33d80e3e7622932d3bc10
SHA512 80add9b5ac415dbcbd8d4c080b11a0718465f4a0fc0698011482424154b521fdaeaca6de9e6c249ed3343796fb3c18a03cd116a83f9fd94e7a091f2845eae70d
SSDEEP 384:577bwBFdbDGtYBqU1bZmqG0vYoJ3cKUmRJuFyblx4/3lr:5736Bd+KLzJuFybX4/3lr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware persistence stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1536	240606500.exe

Loads dropped DLL 1 IoCs

pid	Process
4960	Regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jjkdsksE575DC0 = "C:\\Windows\\system32\\servhist.exe"	240606500.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jjkdsksE575DC0 = "C:\\Windows\\system32\\servhist.exe"	240606500.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{245875B5-93F3-429D-FF34-660B2068897C}	Regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\servhist.exe	240606500.exe
File opened for modification	C:\Windows\SysWOW64\servhist.exe	240606500.exe
File created	C:\Windows\SysWOW64\E575DC0.dll	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{245875B5-93F3-429D-FF34-660B2068897C}\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{245875B5-93F3-429D-FF34-660B2068897C}\InProcServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{245875B5-93F3-429D-FF34-660B2068897C}\InProcServer32\ = "C:\\Windows\\SysWow64\\E575DC0.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{245875B5-93F3-429D-FF34-660B2068897C}\InProcServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{245875B5-93F3-429D-FF34-660B2068897C}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{245875B5-93F3-429D-FF34-660B2068897C}\ = "C:\\Windows\\SysWow64\\E575DC0.dll"	Regsvr32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1536	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	84
PID 4376 wrote to memory of 1536	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	84
PID 4376 wrote to memory of 1536	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	84
PID 4376 wrote to memory of 4960	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	85
PID 4376 wrote to memory of 4960	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	85
PID 4376 wrote to memory of 4960	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	85
PID 4376 wrote to memory of 3340	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	93
PID 4376 wrote to memory of 3340	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	93
PID 4376 wrote to memory of 3340	4376	ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\240606500.exe
  C:\Users\Admin\AppData\Local\Temp\240606500.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  PID:1536
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s E575DC0.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p2hhr.bat" "C:\Users\Admin\AppData\Local\Temp\ed08543a98223e4abf43b8182346af9b_JaffaCakes118.exe""
  2⤵
  PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240606500.exe

Path C:\Users\Admin\AppData\Local\Temp\240606500.exe
Size 14KB
SHA256 80c0f06397479e88abadfb67d67d887c0b1b7f1e89da3b585a7e00bbd1a43c0d
MD5 3deed8495dd7fef5cb965b945a5a3138
SHA1 1a20e4b8ea015b3b7f76a5b8cfe6084011481d36
SHA512 c2348c3afbab1607ec3fb51d1d964454c0efb5aa7725238824a48d6dfb0af89cee5489ef3c8e52311ae7f3a1f98128c7aa23c4ef519d09a50ff9e65e85f333fc
SSDEEP 384:7rs2yOIBs1Zw//YexPHx8DvivrFjREBXl:+Ym/h5R8ehqBXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

p2hhr.bat

Path C:\Users\Admin\AppData\Local\Temp\p2hhr.bat
Size 44B
SHA256 e8efa9da7c7006640c2f883bec45cc3013dda102fb4ae74dbd45b676c77820bf
MD5 76d2c58bc389bc1cc18aed4ff486a1a2
SHA1 421c4d20655a1270415e550fa9cc8831576abbf6
SHA512 241642d717fbf37c3f0970921f37246c5484a3763cde23dfe0e830ed26bb9347253b68e659a70e7e6017c883024c0ef678023f0b927438d1bda16f89f40d412e
MD5 SHA1 SHA512

Submit Download

E575DC0.dll

Path C:\Windows\SysWOW64\E575DC0.dll
Size 9KB
SHA256 97dafa9b268c68b1aed01508b669ba0506fb2d4ee943df7e3028bfd5e56a773a
MD5 0263f33f9c68c05af5ab991f10e92f16
SHA1 bd9186e6ecc4d697eaa59950fbb29e558511ba87
SHA512 eacfdb0b8d29377869b16497a380ac869fa8f6de0015e804f22a7cca91f72af7db74685d1621fcd0dcbc55386032cc021cf08813f3e29f5ffae34c1da430d268
SSDEEP 96:ZRCIAq/sDf3XW5UrPfs1QNRmZEiQI5pATmL503nEiTAICzFKKzMZ3UNNKAdmeiRe:CIAgcOqTU1QNRmnfFLYAICRzAZ3wzVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1536-16-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1536-5-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1536-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/1536-20-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4376-15-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4376-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4376-17-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4376-24-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4376-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4960-14-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/4960-13-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/4960-12-0x0000000010000000-0x0000000010008000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads