46b7317b32166de80872ae31def73c863614a105da8c72286a8adbc8b5cdc2d5

Analysis

max time kernel
141s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe
Size 379KB
Sample240620-sghjcatdpd
SHA256 46b7317b32166de80872ae31def73c863614a105da8c72286a8adbc8b5cdc2d5
MD5 07198dff4577af6a4644157fc30321cf
SHA1 e07a900ff6f65a82d52c2bc9b41c7b6263e9b737
SHA512 0219e2d05dafcb7ed7a867a9b5bcc2633b77c10b27aeea2d3ea63bf2ff741a63cb22aaaef709ed914e3a83f11fc33fafe719357ae1539cd105b40ae019c83e95
SSDEEP 6144:pRvtpgKHNUk/6vDv+vTwRT72cYFTQVFMDdK2fbIMOVFBJYHMxC9IANaaNwVP0JOX:prCqUg6vDMsePR0LVjaHMxCyANh00Qcm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2820	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9A568672-D437-469E-86C2-F6E4A1156071}	Regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\resiifers.ini	07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ihpcnabthk.dll	07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ihpcnabthk.IEExtend	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ihpcnabthk.IEExtend\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ihpcnabthk.IEExtend\Clsid	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\ProgID\ = "ihpcnabthk.IEExtend"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\InprocServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\InprocServer32\ = "C:\\Windows\\SysWow64\\ihpcnabthk.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ihpcnabthk.IEExtend\Clsid\ = "{9A568672-D437-469E-86C2-F6E4A1156071}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A568672-D437-469E-86C2-F6E4A1156071}\ProgID	Regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2820	2980	07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe	82
PID 2980 wrote to memory of 2820	2980	07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe	82
PID 2980 wrote to memory of 2820	2980	07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07198dff4577af6a4644157fc30321cf_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s C:\Windows\system32\ihpcnabthk.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ihpcnabthk.dll

Path C:\Windows\SysWOW64\ihpcnabthk.dll
Size 215KB
SHA256 7ce74e889e58997081cd74b8494bfa8113aaf71c9ef7deb9b63afae5b37ac828
MD5 17c045e8ab74fe28037527dc29bdb3db
SHA1 979a70a859206c186d514787a4b54a5307a4a83c
SHA512 cfce9ebad15843adf70d892c2ae0f1130ddbf2c0cd5e76a4863d01a169aa1bd27dacf0155c273a3200a789d093aa5cfa787ae129c36acd068786100ab85fbb44
SSDEEP 6144:zfX6GULYjmqA/P7fVkpa95OFErSmkIQ4OqOfzzaU:GGULYiH/P7ypC5XWmrQFzzf
MD5 SHA1 SHA512 SSDEEP

Submit Download

resiifers.ini

Path C:\Windows\SysWOW64\resiifers.ini
Size 83B
SHA256 5bbd19a78d65ee5a4da89b1acb7435a63e9b98165699fb381d927847881e7d54
MD5 f5462588a366bbb817efc97034062ad0
SHA1 3a0cb29e0c436a5f9d53b455a8033599bfd89093
SHA512 ecdd1925f694c428f2e5cbf4bc64c2e80301c1576f71bdde88efa05bc5ecffc75767466cec69b7e1349977b963b77878a0e46e8fe344af29ee0251c7f6284a26
MD5 SHA1 SHA512

Submit Download

memory/2820-12-0x0000000000F70000-0x0000000000F72000-memory.dmp

Download

memory/2820-11-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2980-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/2980-1-0x0000000000620000-0x0000000000622000-memory.dmp

Download

memory/2980-8-0x0000000002120000-0x0000000002121000-memory.dmp

Download

memory/2980-13-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/2980-14-0x0000000000620000-0x0000000000622000-memory.dmp

Download

memory/2980-15-0x0000000002120000-0x0000000002121000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads