1c0ea41a70781315440312506580579d6cec23288406d54adfc9fe12d4980ddb

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b66d9603d3359ccb1aabc9f5779b0553_JaffaCakes118.dll
Size

216KB
MD5

b66d9603d3359ccb1aabc9f5779b0553
SHA1

d0e24bdd8ef3da5fc82540f11a983de2f921f1d4
SHA256

1c0ea41a70781315440312506580579d6cec23288406d54adfc9fe12d4980ddb
SHA512

44bce501e229c0eb863f185dc60f30315e353fad1fe3c7ad39e47cde02f05ee6710e04a220012e77a33d886b1ca0c34e1f27f8d33ca53210384ce16906687e53
SSDEEP

6144:HCaFa8yclQhILyrBNDgb4+tAwB1xpxl0bWn1CGnjjiQzefT:iaFdWrorjPiL

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5076	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E2F0C84-2D35-09B8-355E-327522382A98}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E2F0C84-2D35-09B8-355E-327522382A98}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\3026\inf3026.dat	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Registration\DigitalProductSubId = 352d0000840c000075320000b8090000982a00002f0e0000382200005e35000075d20b00	regsvr32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\MiscStatus\ = "9638"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\MiscStatus\cp = "¸°ÓÏâèßëôñ]u\|wykt;;f><?Dky\x7fxFDGLE\|zŽ"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\ = "Java(tm) Plug-In 2 SSV Helper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b66d9603d3359ccb1aabc9f5779b0553_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\MiscStatus	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E2F0C84-2D35-09B8-355E-327522382A98}\MiscStatus\ID = "11"	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1840	4736	regsvr32.exe	84
PID 4736 wrote to memory of 1840	4736	regsvr32.exe	84
PID 4736 wrote to memory of 1840	4736	regsvr32.exe	84
PID 1840 wrote to memory of 5076	1840	regsvr32.exe	94
PID 1840 wrote to memory of 5076	1840	regsvr32.exe	94
PID 1840 wrote to memory of 5076	1840	regsvr32.exe	94

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b66d9603d3359ccb1aabc9f5779b0553_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b66d9603d3359ccb1aabc9f5779b0553_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\3026 /setintegritylevel (OI)(CI)low /T /C
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\3026\inf3026.dat

Filesize
3KB

MD5
7fb5d630552af2d3464e8458241abc7e

SHA1
e0e3e0b7c3d0c221712e74c2616ae8eeddc3023a

SHA256
52921a6b8ae6b6a7bae333a5c8c0feeab9f614ca2b46f4114fb0768e4d04a82d

SHA512
17a451fd5abd8342fef7815a252d1d8fb293a5e93ad43d0162dedf979a083f26aa46c77c63b18b03ebc148365b04eb9dd6a1537170d3b4101641f438eff2c6df

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads