7a0e19ca69001b2a2cb2a5368719afc432ec1812cad7b1911ef6ed64ead5d85c

General

Target

103370b5f96868bef46502eeb5259aed_JaffaCakes118.dll
Size

236KB
MD5

103370b5f96868bef46502eeb5259aed
SHA1

509c25df3834aa057d8fc91b7870182e114e64eb
SHA256

7a0e19ca69001b2a2cb2a5368719afc432ec1812cad7b1911ef6ed64ead5d85c
SHA512

f0869311e2ebc25aef3bb03d1a57b96c9a23bbda8a715a580ad70fbd8646cfd682debf2b22e36e2d841b749961a0475010d2047b18df522bfcf8ee00aa803304
SSDEEP

3072:ART+V0SFseNgnBRVP05ksNPw6TrsAkZ9oJcRa8aPgZAk1NVvtRATk:Ad+VdFse6RVPEkMwMTc1bZAk1NtGk

Score

7^/10

adware persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\NoExplorer = "1"	regsvr32.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\AppID = "{74DB2CD7-094B-4d60-9656-ADC2F8830D29}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho\CurVer\ = "linkrdr.AIEbho.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho.1\CLSID\ = "{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ProgID\ = "linkrdr.AIEbho.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\TypeLib\ = "{2B63B21A-4075-4298-A569-D8113F1D7045}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\103370b5f96868bef46502eeb5259aed_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho.1	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho.1\ = "Adobe PDF Reader Link Helper"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho\CLSID\ = "{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\linkrdr.AIEbho\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}\VersionIndependentProgID\ = "linkrdr.AIEbho"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1472	1504	regsvr32.exe	80
PID 1504 wrote to memory of 1472	1504	regsvr32.exe	80
PID 1504 wrote to memory of 1472	1504	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\103370b5f96868bef46502eeb5259aed_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\103370b5f96868bef46502eeb5259aed_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1472