e6a130f8ba2a150bbb98f9305f9fbde1d300c03f758cb1d5e0ce1ed8690ba6a6

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f608d2ff99da158b785aa1772c52c12_JaffaCakes118.dll
Size

86KB
MD5

3f608d2ff99da158b785aa1772c52c12
SHA1

bd713996fb5bc52c12d70036b2ab9323f95de1be
SHA256

e6a130f8ba2a150bbb98f9305f9fbde1d300c03f758cb1d5e0ce1ed8690ba6a6
SHA512

ba6786caf7b6ef7fe2c8af6d94214103413940faa1c97219c7ecd211ac98856169276035237e93047e6609a9597b70ed61e2af357f970c26a17e0718d5f485c4
SSDEEP

1536:2D5wzSDmQq7wbSSokNrU/4VZZYElD++XOmTeNINap/8lWVZnJwfko/gM7DIVJ90:k8wbSf4je0emThAp/8oVZOfb/gMnI6

Score

6^/10

adware discovery stealer upx

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	regsvr32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1372-0-0x0000000010000000-0x0000000010146000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{825CF5BD-8862-4430-B771-0C15C5CA8DEF} = 00	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{825CF5BD-8862-4430-B771-0C15C5CA8DEF} = "EliteToolBar"	regsvr32.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\TypeLib\ = "{CA9FC31A-6F35-4493-B629-E64BD6170A17}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\ = "IEliteBarImpl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\TypeLib\ = "{CA9FC31A-6F35-4493-B629-E64BD6170A17}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ThreadingModel = "Apartment"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\ = "&EliteBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3F608D~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f608d2ff99da158b785aa1772c52c12_JaffaCakes118.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\TypeLib\ = "{CA9FC31A-6F35-4493-B629-E64BD6170A17}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\ = "&EliteBar"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ThreadingModel = "Apartment"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\Programmable	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\ = "INavigator"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\TypeLib\ = "{CA9FC31A-6F35-4493-B629-E64BD6170A17}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3F608D~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28CAEFF3-0F18-4036-B504-51D73BD81ABC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\ = "&EliteBar"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\ = "IEliteBarImpl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9B28EF6-ABF3-463B-A3D8-4D0D0BADFADC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{825CF5BD-8862-4430-B771-0C15C5CA8DEF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\ = "EliteBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA9FC31A-6F35-4493-B629-E64BD6170A17}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\ = "INavigator"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF33E89-1784-42AC-ADE4-A428F56550A3}\ProxyStubClsid32	regsvr32.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3828	regedit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 1372	4576	regsvr32.exe	83
PID 4576 wrote to memory of 1372	4576	regsvr32.exe	83
PID 4576 wrote to memory of 1372	4576	regsvr32.exe	83
PID 1372 wrote to memory of 3828	1372	regsvr32.exe	84
PID 1372 wrote to memory of 3828	1372	regsvr32.exe	84
PID 1372 wrote to memory of 3828	1372	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f608d2ff99da158b785aa1772c52c12_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f608d2ff99da158b785aa1772c52c12_JaffaCakes118.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s /c "C:\Users\Admin\AppData\Local\Temp\\install.reg"
    3⤵
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Runs .reg file with regedit
    PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.reg

Filesize
1KB

MD5
3c4bc71dea7fe98721f9f140e032b040

SHA1
996e1e295b6c0574d78f10011dbf4ce9eef4bd84

SHA256
63469d32206ef74dc2f49015f21d20ef18e3b43aa8d26cadc7eb7a3c15aa25f7

SHA512
db8169f0260b0fa5c9d225c270c871aad26effbf66c069175d44a864eb545552f7e3014506922325bdda7d76aa633f00bcec364bb7a2a77662a44de7add918ac

Download Submit
memory/1372-0-0x0000000010000000-0x0000000010146000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads