64f9c7790b4037e55a35d775e2f25a94bd09f0b245d73af08dcd1f606159996a

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe
Size

57KB
MD5

bd3cb1eb94f951fc5c56967c8c0eea86
SHA1

a9b5f3c167d78287918d247ce743b73af5a84783
SHA256

64f9c7790b4037e55a35d775e2f25a94bd09f0b245d73af08dcd1f606159996a
SHA512

285c5f1a1d2828dc78a3e6609fa92f57e552959df514003222324224cf6aa5f90bb45452aa6ee8419a71505b43f1546904aa945f08eae29b392bb15118e40405
SSDEEP

768:ryESznCIdH45oA0PnE6KPP2kUWZZN+wK3bZWjr9nID9RDYP54kNJa6KPQBia++Rs:bSznCIK5oAuKP80NyEjxIhGP5+6q+Ds

Score

7^/10

adware discovery stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000016d74-1.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016d74-1.dat	upx
behavioral1/memory/2444-2-0x0000000010000000-0x00000000104B2000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72A128E0-2240-40c8-9E92-5387D64F839E}	regsvr32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xml2u32h.dll	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP.1\CLSID\ = "{72A128E0-2240-40c8-9E92-5387D64F839E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\InprocServer32\ = "C:\\Windows\\xml2u32h.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP.1\ = "XMLDP Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\ = "{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP\CLSID\ = "{72A128E0-2240-40c8-9E92-5387D64F839E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\TypeLib\ = "{6D0111E3-3060-4d23-B2BC-42ED86CBE9A3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\ = "XMLLIB 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ = "IDocEventHandler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\ = "{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\ = "XMLDP Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\ = "{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ = "IDOMPeek"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP\ = "XMLDP Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP\CurVer\ = "XMLLIB.XMLDP.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\0\win32\ = "C:\\Windows\\xml2u32h.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ = "IDocEventHandler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ = "IDOMPeek"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XMLLIB.XMLDP	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\ProgID\ = "XMLLIB.XMLDP.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\HELPDIR\ = "C:\\Windows\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\ = "{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72A128E0-2240-40c8-9E92-5387D64F839E}\VersionIndependentProgID\ = "XMLLIB.XMLDP"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D0111E3-3060-4D23-B2BC-42ED86CBE9A3}\1.0\0\win32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31
PID 2120 wrote to memory of 2444	2120	bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\xml2u32h.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\xml2u32h.dll

Filesize
52KB

MD5
41f6cbfcb0769126f7b2f230b9dc1416

SHA1
0d83c777cdbbb5bb02c56f4c3ca69634a063e60c

SHA256
77dc6b08d30e632f5a1c04a8a2fedf4dc82810c3f9baff3f1ef4ebd08225a1ec

SHA512
b6a0187fb2623dda9b88be2c68d8c829af7b5df999bd94ed0d2c8897d89867d2cdb0e8457a514f5926e398fcee77d33cc37a6d5832f8bbe33d5cda57c1c28ca3

Download Submit
memory/2444-2-0x0000000010000000-0x00000000104B2000-memory.dmp

Filesize
4.7MB

Download