Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1acda225577482b2e9799355edaecbe4_JaffaCakes118.dll
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
1acda225577482b2e9799355edaecbe4_JaffaCakes118.dll
-
Size
142KB
-
MD5
1acda225577482b2e9799355edaecbe4
-
SHA1
a7826a8c91560a92f19c733eead3aec35d092109
-
SHA256
9b9478f36d9c360ab3ff2bc8afa20b76328c6e721fd6c36e4369f7b404a3e69d
-
SHA512
96ececb7ff02ff47f65079fbe3c18cc83415693fccb64da65fc6fd6617e05bd03a6fc4d0f34de2fc03fec0fa9eca47911a02e250d3ac7f9d75d2a3155d2e78b8
-
SSDEEP
3072:wEk6AlK+xE24sCTJdMIaTCmkWt55jBpX:06AlJK2yl2XZj
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ = "Game Add-on ArcadeWeb" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2} regsvr32.exe -
Modifies registry class 60 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ = "_IExtensionEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon\ = "Game Add-on ArcadeWeb" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ = "Game Add-on ArcadeWeb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon.1\CLSID\ = "{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ = "_IExtensionEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\VersionIndependentProgID\ = "AModule.Addon" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon\CurVer\ = "AModule.Addon.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon\CLSID\ = "{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\TypeLib\ = "{2A04A1D0-1969-400e-A53C-6A5433A4B658}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AModule.Addon.1\ = "Game Add-on ArcadeWeb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib\ = "{2A04A1D0-1969-400E-A53C-6A5433A4B658}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ = "IExtension" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ProgID\ = "AModule.Addon.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ = "IExtension" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\ = "ExpExt TLib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1acda225577482b2e9799355edaecbe4_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1acda225577482b2e9799355edaecbe4_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21C1577D-B190-4F9D-8034-F26DE5F9F3C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9D903F6-26EF-4716-BBD0-D9513E8FDE9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2A04A1D0-1969-400E-A53C-6A5433A4B658}\1.0\FLAGS\ = "0" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1932 1660 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1acda225577482b2e9799355edaecbe4_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1acda225577482b2e9799355edaecbe4_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class