Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 18:06
Static task
static1
Behavioral task
behavioral1
Sample
fd52cd9bfb7b40a3992c2ec5f42bdcb8_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fd52cd9bfb7b40a3992c2ec5f42bdcb8_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
fd52cd9bfb7b40a3992c2ec5f42bdcb8_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
fd52cd9bfb7b40a3992c2ec5f42bdcb8
-
SHA1
9f0a0af3faf66b2715f575fd56a7a2968a077b47
-
SHA256
26be0ba3533703f5eeea8489e6a8881461dab7f597f33e546182ba1910953d09
-
SHA512
d83cc92992a35c4c06507e5ad4804d822acb8aa2f61cc34763ed72e596dbeab67b5554eedd15b33a9649f93044c49d43c0b6eb4c195b6906041465a2d70a195d
-
SSDEEP
24576:ax12nIqqCgOgFO9fccuUMHKv+i7e1LXEdFoGzIyXjxeKF:aYIqJPV9fcHqmGSr9oF
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/2380-0-0x0000000027FA0000-0x0000000028004000-memory.dmp BazarLoaderVar3 behavioral2/memory/2380-1-0x00007FF894670000-0x00007FF894812000-memory.dmp BazarLoaderVar3 behavioral2/memory/2380-7-0x00007FF894670000-0x00007FF894812000-memory.dmp BazarLoaderVar3 behavioral2/memory/2380-8-0x0000000027FA0000-0x0000000028004000-memory.dmp BazarLoaderVar3 behavioral2/memory/2772-9-0x0000000027C30000-0x0000000027C94000-memory.dmp BazarLoaderVar3 behavioral2/memory/2772-10-0x00007FF894670000-0x00007FF894812000-memory.dmp BazarLoaderVar3 behavioral2/memory/2772-17-0x00007FF894670000-0x00007FF894812000-memory.dmp BazarLoaderVar3 behavioral2/memory/2772-18-0x0000000027C30000-0x0000000027C94000-memory.dmp BazarLoaderVar3 behavioral2/memory/832-21-0x0000000027850000-0x00000000278B4000-memory.dmp BazarLoaderVar3 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 832 regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RealtechUpdate = "\"C:\\Windows\\system32\\regsvr32.exe\" /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Damp\\eykksoxlcvg.exe\" mscp arih" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2772 regsvr32.exe 2772 regsvr32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
regsvr32.execmd.exeregsvr32.execmd.execmd.exedescription pid process target process PID 2380 wrote to memory of 1104 2380 regsvr32.exe cmd.exe PID 2380 wrote to memory of 1104 2380 regsvr32.exe cmd.exe PID 1104 wrote to memory of 2800 1104 cmd.exe PING.EXE PID 1104 wrote to memory of 2800 1104 cmd.exe PING.EXE PID 1104 wrote to memory of 2772 1104 cmd.exe regsvr32.exe PID 1104 wrote to memory of 2772 1104 cmd.exe regsvr32.exe PID 2772 wrote to memory of 3940 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 3940 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 2564 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 2564 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 260 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 260 2772 regsvr32.exe cmd.exe PID 260 wrote to memory of 460 260 cmd.exe PING.EXE PID 260 wrote to memory of 460 260 cmd.exe PING.EXE PID 2564 wrote to memory of 3500 2564 cmd.exe reg.exe PID 2564 wrote to memory of 3500 2564 cmd.exe reg.exe PID 260 wrote to memory of 832 260 cmd.exe regsvr32.exe PID 260 wrote to memory of 832 260 cmd.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd52cd9bfb7b40a3992c2ec5f42bdcb8_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\fd52cd9bfb7b40a3992c2ec5f42bdcb8_JaffaCakes118.dll" mscp ahis & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 83⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\fd52cd9bfb7b40a3992c2ec5f42bdcb8_JaffaCakes118.dll" mscp ahis3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c echo %temp%4⤵
-
C:\Windows\system32\cmd.execmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\eykksoxlcvg.exe\" mscp arih"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\eykksoxlcvg.exe\" mscp arih"5⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\eykksoxlcvg.exe" mscp arih & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\eykksoxlcvg.exe" mscp arih5⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Damp\eykksoxlcvg.exeFilesize
1.3MB
MD5fd52cd9bfb7b40a3992c2ec5f42bdcb8
SHA19f0a0af3faf66b2715f575fd56a7a2968a077b47
SHA25626be0ba3533703f5eeea8489e6a8881461dab7f597f33e546182ba1910953d09
SHA512d83cc92992a35c4c06507e5ad4804d822acb8aa2f61cc34763ed72e596dbeab67b5554eedd15b33a9649f93044c49d43c0b6eb4c195b6906041465a2d70a195d
-
memory/832-21-0x0000000027850000-0x00000000278B4000-memory.dmpFilesize
400KB
-
memory/2380-0-0x0000000027FA0000-0x0000000028004000-memory.dmpFilesize
400KB
-
memory/2380-1-0x00007FF894670000-0x00007FF894812000-memory.dmpFilesize
1.6MB
-
memory/2380-7-0x00007FF894670000-0x00007FF894812000-memory.dmpFilesize
1.6MB
-
memory/2380-8-0x0000000027FA0000-0x0000000028004000-memory.dmpFilesize
400KB
-
memory/2772-9-0x0000000027C30000-0x0000000027C94000-memory.dmpFilesize
400KB
-
memory/2772-10-0x00007FF894670000-0x00007FF894812000-memory.dmpFilesize
1.6MB
-
memory/2772-17-0x00007FF894670000-0x00007FF894812000-memory.dmpFilesize
1.6MB
-
memory/2772-18-0x0000000027C30000-0x0000000027C94000-memory.dmpFilesize
400KB