d49f9dd0809bba9f4e022c0d0e94c4d1fdf203aa1f09ce4b7a6dece4f8e6805f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.dll
Size

567KB
MD5

5c25f2d8db07293c4d7895256376b39e
SHA1

5dbf2ff2ef9f2e4d99325d0a3fed5f5936a1e146
SHA256

d49f9dd0809bba9f4e022c0d0e94c4d1fdf203aa1f09ce4b7a6dece4f8e6805f
SHA512

71073769d20931076f36fe5d2fa38d37f3e99380f0a98ded030e7b144fdcaff2cb53bca0c04bac0aa8921ddc4e067b0468d8bd7a78bf503f31d1f3e18a58d77d
SSDEEP

12288:HHCqAM6vj9ASYe9dPSQBN9KtJ6IMLxaoSDVjEty7PNc+HO:HiqTyp3PSQNKP9MLxaoS2ty7ak

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}	regsvr32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.sh\ = "sh"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.sh\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.sh	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.sh\Clsid\ = "{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}\ProgID\ = "5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.sh"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-75E3-DEDC-69AA-2ED73D83D5B9}\ = "sh"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31
PID 3024 wrote to memory of 2224	3024	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5c25f2d8db07293c4d7895256376b39e_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000002240000-0x00000000022D3000-memory.dmp

Filesize
588KB

Download