43c8ff3cf5754fb57a4d05f18422417545cc3300fd7ae9e4a81e1a7463cb6020

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Size 108KB
Sample240512-der8fadb8t
SHA256 43c8ff3cf5754fb57a4d05f18422417545cc3300fd7ae9e4a81e1a7463cb6020
MD5 37e2917aeb9e42b3050c0108c89ca35a
SHA1 b804f3e879e99764c1953f3678f637cd84051492
SHA512 eae7fe9cb36f24985ab1f193253998ceaa9dfd5fd77d272cad1621bcc3ca3607d0b3d68a5cd0b5275c7b401c0321c0bb78c36bcdfd1224f679a528857dcdb6e0
SSDEEP 1536:mrNqpapZhzXTFvZ26Q8wYUkTOl5Tg65pJj/y6qluDGPvHps:mr8oBLTFh26QDNeULu6qlu8C
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3792	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shock.dll"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\0\win32	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\TypeLib\ = "{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\ProxyStubClsid32	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv.1\ = "Adv Class"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\ProgID\ = "Urladv.Adv.1"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\TypeLib	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\InprocServer32	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\InprocServer32\ThreadingModel = "Apartment"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv\CurVer	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\ = "Adv Class"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\ProgID	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\TypeLib\ = "{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv\CLSID	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv\CLSID\ = "{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\ProxyStubClsid32	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\ = "urladv 1.0 Type Library"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\VersionIndependentProgID\ = "Urladv.Adv"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\FLAGS	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\ = "IAdv"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\TypeLib	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\ = "IAdv"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv\CurVer\ = "Urladv.Adv.1"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\TypeLib\Version = "1.0"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\FLAGS\ = "0"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\HELPDIR	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\TypeLib\Version = "1.0"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv.1	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\TypeLib	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FBF2D-FE00-44E6-8A98-B4350960D943}\TypeLib\ = "{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv.1\CLSID\ = "{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\0	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv\ = "Adv Class"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\VersionIndependentProgID	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shock.dll"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8003D2E5-F50C-4DC2-9670-C44ABCABCE02}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Urladv.Adv.1\CLSID	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE16FA9-E135-43B5-8236-A0CC75F60BB6}\Programmable	37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37e2917aeb9e42b3050c0108c89ca35a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shock.dll

Path C:\Users\Admin\AppData\Local\Temp\shock.dll
Size 60KB
SHA256 ad31acbcdfeaf5c78b6e81b9d257d987fe14c6fb7c519e695abd25367175af53
MD5 5835b33dfa696bba76f4c828f4ea6529
SHA1 95bfb4580bd3e700a3461dd0d1d8e46d2d3e0b22
SHA512 e247e802006347951c1b7ac582e03e6b7a7b21c0df89af22b9ef58dcf43ec8bcc99f2a77add5c4dee8f7964be2059a066b303f99cfafbfc32443e758e9f9eafa
SSDEEP 1536:zZ26Q8wYUkTOl5Tg65pJj/y6qluDGPvHps:l26QDNeULu6qlu8C
MD5 SHA1 SHA512 SSDEEP

Submit Download