212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e

General

Target
jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe
Size 124KB
Sample260925-v49bpatv2m
SHA256 212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e
MD5 71554ae8b4caa464fa694e62ff765b1c
SHA1 aea202625d2854c5c47a48a638601678801514f3
SHA512 fc39f9de6e93082de74c84f6cf99ad69ab7716f1525f31dc30a6136ff772305d0816eb19d52621a8afe3a4d20f2977f646f890c837aa08ef5a4ab21f61b3f82f
SSDEEP 1536:Re6H5TaUkG6jtYZl26cgRFiP5uhNIieLtS5To9vDQB9mziuzMjAzR7Vk8nOZKuMP:RvZNXZliu4mCVrg7UEE6tp/A
TLSH
T1D0C33B215F9065B2E00006742576A7F2E36AEF703972EFB2D76039391C399B74684FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery stealer

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1876	regsvr32.exe
1876	regsvr32.exe
1152	regsvr32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{749B4F65-6F76-4263-A666-07642B79F1E3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{749B4F65-6F76-4263-A666-07642B79F1E3}\	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\iBDNS.Dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\ = "BDN"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\TypeLib\ = "{F5604774-9DDB-4DAA-8BE0-372044A910AA}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1152	regsvr32.exe
1152	regsvr32.exe
1152	regsvr32.exe
1152	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4796	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1876	4796	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe	88
PID 4796 wrote to memory of 1152	4796	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe	89
PID 4796 wrote to memory of 1564	4796	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe	90
PID 4796 wrote to memory of 1144	4796	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe	91
PID 4796 wrote to memory of 2700	4796	jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe"
1⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Roaming\Microsoft\iBDNS.Dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Roaming\Microsoft\CheckURL.Dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s /u "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_bho.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s /u "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_bho.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\jaffacakes118_212a12bd00ab5e92b32398219a7c90892456f7cad666dc83d95d622079c2890e.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckURL.Dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\CheckURL.Dll
Size 44KB
SHA256 63386b2220a687db6889750452617efbb0093601dac68c181bf6960f9b831a21
MD5 a90ea7970bc04c7292455eedfd24d64c
SHA1 3e0e94126e6e41fe4fa61638612ebfe0d975169b
SHA512 7e7061d5199adb286bff7cec3153697f7497d61b7ec8448aa75d5afe1a4fdaef998e089e2b6ed37ff2540defd9b0c366243d0ad7850d0a4709e4345eca775fe1
SSDEEP 768:QBtSKmToX3TBoWDoNBo8moWionzoBjAmgR7Vk88COZKuYpa1lvK1i5QMT0rjEc9C:4tS5To9vDQB9mziuzMjAzR7Vk8nOZKu1
TLSH
T14A136D212FE175B1C45007B12A597BF1DA35FB200832ADA3E7A4252D6D718E3EA0C66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iBDNS.Dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\iBDNS.Dll
Size 55KB
SHA256 e170aa90f14c1c8ae4eeac7661c3489f5952432983417b51f8ebbe682020aa1f
MD5 86cb7a5be74936f10bba782568c13bf8
SHA1 6d4c6e1950e0b25f6b5c2ec9d716a89ea709e8ee
SHA512 46251cc8b40a61dc0dab51c319a3f6b5a73b539970967af923f487280d4d6d4dd74e0504676648eb853e7dc7558a4082a96f96ff064862ab8d181a252391e41a
SSDEEP 768:QEHUWVG6jtlPvmuMlvKVMRQ5All26OS0gz9FCZtfP31+u/b5uhmMIie:ikG6jtYZl26cgRFiP5uhNIie
TLSH
T177430621AF4065B2F40016782576E7A2F26EEE60B962FF7297603D291C3C57346C4FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-13-0x000000000040B000-0x000000000040C000-memory.dmp

Download

memory/1876-6-0x00000000009C0000-0x00000000009D1000-memory.dmp

Download

memory/1876-7-0x00000000009CE000-0x00000000009CF000-memory.dmp

Download

memory/4796-14-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads