da2034ee165ecf5085c5b89db7d9a003de6464b4f3a81ad5aab8cea5b479098c

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.dll
Size

607KB
MD5

45dc15d2b5dd6c4454297f9d6fd9d088
SHA1

f311d7d895ac4b0b52b0773d7f45c79ee9c17805
SHA256

da2034ee165ecf5085c5b89db7d9a003de6464b4f3a81ad5aab8cea5b479098c
SHA512

6c3dc2903fa1d6f2f16d209f8f9871f2d2a7b65fa0611ba7b1ce9f00660041c7a29ed0b322ee086269551bdf9985671da324612d47dc01ac17392fddc3c37f85
SSDEEP

12288:tpIt9HX65cspWkY5DARyLuaIg3QaoIrbfujl50O/:tetFXsoB7LGnaoIrbGjl50O

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-448A-1584-9C46-D95179869F99}	regsvr32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.iwc\ = "iwc"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.iwc\Clsid\ = "{CC01FC6C-448A-1584-9C46-D95179869F99}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}\ = "iwc"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.iwc	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.iwc\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-448A-1584-9C46-D95179869F99}\ProgID\ = "45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.iwc"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4548	4316	regsvr32.exe	82
PID 4316 wrote to memory of 4548	4316	regsvr32.exe	82
PID 4316 wrote to memory of 4548	4316	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\45dc15d2b5dd6c4454297f9d6fd9d088_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads