4a3ece4d9c37ef4f374d382fa720d531d8ecf32df5101867740f1955e0fe057b

General

Target

8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
Size

310KB
MD5

8581e134a86dd6d70a721dfb8823d226
SHA1

61896bee7e9019ff51f12411a1fc43f5e8ba53de
SHA256

4a3ece4d9c37ef4f374d382fa720d531d8ecf32df5101867740f1955e0fe057b
SHA512

2c486dd593ac4b4ee63c4908a22009e2f6d76af96871dc336c9b1caae663a37ceed068d0a5e816fe16c8d52f6fe8f5c117092f46384fcbcc654a0c056da0c880
SSDEEP

6144:kNJAz0XVNRAKg1rYZy6yEMXVjn3LxolcITz1Ir7TeCAQ/GYpDYezocDFA:8RA1UyvFz4eP9pDhzoqA

Score

7^/10

adware aspackv2 discovery stealer

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000016d2a-2.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
2744	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C68B0149-C717-4041-BF00-C21569B97019}	Regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windownewsups.ini	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tcyijxgzzzlic.dll	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Regsvr32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tcyijxgzzzlic.IEExtend\Clsid\ = "{C68B0149-C717-4041-BF00-C21569B97019}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tcyijxgzzzlic.IEExtend	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tcyijxgzzzlic.IEExtend\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tcyijxgzzzlic.IEExtend\Clsid	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\ProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\ProgID\ = "tcyijxgzzzlic.IEExtend"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32\ = "C:\\Windows\\SysWow64\\tcyijxgzzzlic.dll"	Regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2744	1824	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s C:\Windows\system32\tcyijxgzzzlic.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tcyijxgzzzlic.dll

Filesize
249KB

MD5
97af2e03e301ba865ecdf9ce959b4afd

SHA1
841ed37d2fc525a2b5a07638d173e19c0ef3a270

SHA256
f16b4ca83b484a6b2447d78c4524acec370ac9e8fa7d03b85cf347711ec27c7f

SHA512
8936e7418ea203d1e0f13f9af9829bc228cde103792ad56f6a8b05caa9721ec2ecf3df3a8c46cd4d4a8ac346ba3cd7e02f4e0887510c56e55c90ddac119a9f49

Download Submit
memory/1824-4-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing