4a3ece4d9c37ef4f374d382fa720d531d8ecf32df5101867740f1955e0fe057b

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
Size

310KB
MD5

8581e134a86dd6d70a721dfb8823d226
SHA1

61896bee7e9019ff51f12411a1fc43f5e8ba53de
SHA256

4a3ece4d9c37ef4f374d382fa720d531d8ecf32df5101867740f1955e0fe057b
SHA512

2c486dd593ac4b4ee63c4908a22009e2f6d76af96871dc336c9b1caae663a37ceed068d0a5e816fe16c8d52f6fe8f5c117092f46384fcbcc654a0c056da0c880
SSDEEP

6144:kNJAz0XVNRAKg1rYZy6yEMXVjn3LxolcITz1Ir7TeCAQ/GYpDYezocDFA:8RA1UyvFz4eP9pDhzoqA

Score

7^/10

adware aspackv2 discovery stealer

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000023394-2.dat	aspack_v212_v242

Loads dropped DLL 2 IoCs

pid	Process
4328	Regsvr32.exe
4328	Regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C68B0149-C717-4041-BF00-C21569B97019}	Regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windownewsups.ini	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wefhctgkilvxm.dll	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Regsvr32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wefhctgkilvxm.IEExtend\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wefhctgkilvxm.IEExtend\Clsid	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\ProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\ProgID\ = "wefhctgkilvxm.IEExtend"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32\ = "C:\\Windows\\SysWow64\\wefhctgkilvxm.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68B0149-C717-4041-BF00-C21569B97019}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wefhctgkilvxm.IEExtend	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wefhctgkilvxm.IEExtend\Clsid\ = "{C68B0149-C717-4041-BF00-C21569B97019}"	Regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4328	1256	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	84
PID 1256 wrote to memory of 4328	1256	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	84
PID 1256 wrote to memory of 4328	1256	8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8581e134a86dd6d70a721dfb8823d226_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s C:\Windows\system32\wefhctgkilvxm.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wefhctgkilvxm.dll

Filesize
249KB

MD5
97af2e03e301ba865ecdf9ce959b4afd

SHA1
841ed37d2fc525a2b5a07638d173e19c0ef3a270

SHA256
f16b4ca83b484a6b2447d78c4524acec370ac9e8fa7d03b85cf347711ec27c7f

SHA512
8936e7418ea203d1e0f13f9af9829bc228cde103792ad56f6a8b05caa9721ec2ecf3df3a8c46cd4d4a8ac346ba3cd7e02f4e0887510c56e55c90ddac119a9f49

Download Submit
memory/1256-5-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download