Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 13:37
Static task
static1
Behavioral task
behavioral1
Sample
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe
-
Size
156KB
-
MD5
1a5333bd9c4b99beea35bfa0aa195167
-
SHA1
73d51cb8261b5f60dd5ccd31104872f3a170b93f
-
SHA256
661d4ce00fb9823f46fbcf9944a8b1c69774c42c8d1a1710eac113493bc3897b
-
SHA512
37efef086c250dd0e02b536a7bcb235f1561d6d6f8d58bfa7f9c418060e141d11209dc2b9b41157472c11d83ee4c5ff3fac67b54175e8be7106b5099b29a693a
-
SSDEEP
3072:2Uai/8h089T6qCFwE1R6e0QViBiKkOH9yrc/4jBmX9teNVntDb:qf5bCKw60oBFHA3e9gNxVb
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\msxml71.dll acprotect -
Loads dropped DLL 1 IoCs
Processes:
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exepid process 1520 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\msxml71.dll upx behavioral2/memory/1520-209-0x0000000010000000-0x0000000010063000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D} 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
Processes:
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\msxml71.dll 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe -
Modifies registry class 27 IoCs
Processes:
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D} 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1084991C-D150-E406-305C-92E19A035DF1}\.0\ = "C:\\Windows\\SysWow64\\msxml71.dll" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1084991C-D150-E406-305C-92E19A035DF1} 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1084991C-D150-E406-305C-92E19A035DF1}\.0 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1084991C-D150-E406-305C-92E19A035DF1}\.0\ = "XML Library" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Windows\\SysWow64\\msxml71.dll" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{1084991C-D150-E406-305C-92E19A035DF1}" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class" 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exepid process 1520 1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a5333bd9c4b99beea35bfa0aa195167_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\msxml71.dllFilesize
126KB
MD59741ea24b268c7a72c1bc79267ab4cff
SHA11dd0612f0c3d90436979063071e1bdf0761610dc
SHA2564d0a94a2437e66b289af377b08b8ff3377a2de9844ac26410a80a33e879a73c1
SHA5121a1cddd632e6f374764b9fbf421714a86dcae44881569e213a2ab3c2d79be6bbe0640e186cfcd9575c65aad1fe1e8b49a5ca5494b13487ff3f64ccc7d6b50b6d
-
memory/1520-209-0x0000000010000000-0x0000000010063000-memory.dmpFilesize
396KB
-
memory/1520-44810-0x00000000000A0000-0x00000000001A0000-memory.dmpFilesize
1024KB