c87404df80c9f6fa01fb6a077103512fce467fd096679665e809410ca8c5f781

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe
Size

148KB
MD5

c0a47c10bd083b0593af6844b0ec2ddc
SHA1

8b3a782e559856df48b59590b60b0c3186487c3c
SHA256

c87404df80c9f6fa01fb6a077103512fce467fd096679665e809410ca8c5f781
SHA512

7f81945c6264a418842c7d3346330179bc3c94be74ef9c254b33e1de3b5b552219334d2e7d3635bc68a5ada2087f78253576773f266db882ff3e4da294ed9cc1
SSDEEP

3072:gkzlXY3wz24DNpJD+qxTSYC1FTOi15UYWI7VNIN:gkzlXLDrJDTxuYC1FCwjWuN

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bbe052c3-681a-4e7a-b908-f019f5cab55b}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\ = "HelloWorldBHO"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\NoExplorer = "1"	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ssqNDsqn.dll	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\TypeLib	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\TypeLib	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\ = "PeteBH Class"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\TypeLib	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\TypeLib\Version = "1.0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\HELPDIR\ = "C:\\Windows\\system32"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\TypeLib\ = "{78B77446-B235-4B5D-BE44-D9A0518F0F41}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\ = "mainLib"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\TypeLib\ = "{78b77446-b235-4b5d-be44-d9a0518f0f41}"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\0\win32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\HELPDIR	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\ = "IHelloWorldBHO"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\ProxyStubClsid32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\TypeLib\Version = "1.0"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\Version\ = "1.0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\ProxyStubClsid32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\FLAGS	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\InprocServer32\ = "C:\\Windows\\SysWow64\\ssqNDsqn.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\Version	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\FLAGS\ = "0"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78B77446-B235-4B5D-BE44-D9A0518F0F41}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ssqNDsqn.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\TypeLib\ = "{78B77446-B235-4B5D-BE44-D9A0518F0F41}"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CFC91CA-BA5A-4DD3-8F94-0239D13E2A4B}\ = "IHelloWorldBHO"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bbe052c3-681a-4e7a-b908-f019f5cab55b}\Programmable	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2432	2412	c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0a47c10bd083b0593af6844b0ec2ddc_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 "C:\Windows\system32\ssqNDsqn.dll",DllInstall
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ssqNDsqn.dll

Filesize
108KB

MD5
f336c0db4c224fecc72c1d3306c6f9b7

SHA1
7b758347d9d88b53b50774b0f9e233d5b3560977

SHA256
4c32b29743a13f6085b248bd5762e9fda3bb5880d30f0ffb8e1c0b67b8daf1f5

SHA512
340ba322a48574be5d3435536df6c0f08c6b9cbb2e3f41706e0c76715d34abcb1c35c0fa2a8cca5ebadcd25b685223a4b798afb5743bb37f29c3ebb08d870859

Download Submit