Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
1acbbe5b0f3d26e55e8c7f75ada70b90
-
SHA1
377c3a07e34a02b6a684ce3728ec25922a064a3b
-
SHA256
5b47747705de562515fefdfa26eefb61e0737f0eaec479da80305d6975e493bd
-
SHA512
eb378fb0898af8920504d7329b9348e6402d423f5a27846bdf8b3bf1c74cc93dfba6c46ee8cfa9c5c9b946c07b54e3493889db8d4d23d84141ddc362da1baab0
-
SSDEEP
24576:MoCc//////Oi6smRMX+06ZcSbv9AixEh837Zeb241rB3vpl:gc//////Oi6sm2O06yzfb1N3vp
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968} regsvr32.exe -
Modifies registry class 11 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.iwc regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.iwc\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.iwc\Clsid\ = "{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}\ProgID\ = "1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.iwc" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}\ = "iwc" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.iwc\ = "iwc" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-F88D-83DC-12A7-7E1C5827E968}\ProgID regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1900 regsvr32.exe 1900 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1900 2232 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1acbbe5b0f3d26e55e8c7f75ada70b90_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1900-0-0x00000000023B0000-0x00000000024C8000-memory.dmpFilesize
1.1MB