19def93b5f948902c9b71032a902e9e94298fc970ac829f8f5f4830e2e6052c3

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ed3e117ef3fb09e8fa6dacb96caaf58e_JaffaCakes118.dll
Size 196KB
Sample240411-mvl6ssda2w
SHA256 19def93b5f948902c9b71032a902e9e94298fc970ac829f8f5f4830e2e6052c3
MD5 ed3e117ef3fb09e8fa6dacb96caaf58e
SHA1 57591096f91a2a46376c3735f28c86024d2a0d4c
SHA512 881528b0bbef22d2090d75e588a47fecac6916ef83b2c17b8cabac5471b6c4a5f3661616362b8842f7a7bcb97dbfe02b7b182fa50bc9e4114f363bc71949ce65
SSDEEP 3072:NsuNiDhaEY9Zbtm8ajQK+LvsbhZI473W053rw9cG:UScR+LUlZwyb
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ = "LivingPlay"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\NoExplorer = "1"	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\lptlIE.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ed3e117ef3fb09e8fa6dacb96caaf58e_JaffaCakes118.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EF1B578C-4058-4062-890F-31694233FEA5}\ = "lptlIE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\lptlIE.DLL\AppID = "{EF1B578C-4058-4062-890F-31694233FEA5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CurVer\ = "lptlIE.TextLinks.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\VersionIndependentProgID\ = "lptlIE.TextLinks"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1\CLSID\ = "{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ed3e117ef3fb09e8fa6dacb96caaf58e_JaffaCakes118.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\ = "lptlIE 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\ = "LivingPlay"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ = "LivingPlay"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ProgID\ = "lptlIE.TextLinks.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ = "ITextLinks"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CLSID\ = "{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ = "_ITextLinksEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ = "ITextLinks"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ = "_ITextLinksEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EF1B578C-4058-4062-890F-31694233FEA5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1\ = "LivingPlay"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\0\win32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3664	4484	regsvr32.exe	84
PID 4484 wrote to memory of 3664	4484	regsvr32.exe	84
PID 4484 wrote to memory of 3664	4484	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed3e117ef3fb09e8fa6dacb96caaf58e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ed3e117ef3fb09e8fa6dacb96caaf58e_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads