Analysis
-
max time kernel
67s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
04f63e9df9ee48236ace3c32141b1279_JaffaCakes118.dll
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
General
-
Target
04f63e9df9ee48236ace3c32141b1279_JaffaCakes118.dll
-
Size
262KB
-
MD5
04f63e9df9ee48236ace3c32141b1279
-
SHA1
89c20beedb98697f438f66af1b6fa3eda2ead0c8
-
SHA256
15e3a94352e5f3006636f160b88e8f6cdb63efcaa7af17f7b0ddf85b7b296a3d
-
SHA512
56c4a247deafe3206a2fa2d7b672ea1be14047860a26ae4e9bccab655a9ed420b2ab942cdfe3c49c312005ee244e1fdd31dd8b6812441c48f47479f350eb7425
-
SSDEEP
3072:N2CYU/9J7yX8LVxQbqHVOhB+PVG63Qv+8e2mZKT0RUg/MsC1mcEL:N2CYUf+sLVW4VOy+vTmZJ2LY
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{298f32ca-94c4-4808-be02-644b9c7d89cf} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{298f32ca-94c4-4808-be02-644b9c7d89cf}\ = "Wild West 1.0.0.7" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{298f32ca-94c4-4808-be02-644b9c7d89cf}\NoExplorer = "1" regsvr32.exe -
Modifies registry class 34 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\ = "Wild West 1.0.0.7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\TypeLib\ = "{A4E32025-FC62-415F-BF9A-71CA415CA893}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\ = "IWildWest" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\TypeLib\ = "{a4e32025-fc62-415f-bf9a-71ca415ca893}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\ = "IWildWest" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04f63e9df9ee48236ace3c32141b1279_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\ = "WildWestIEClientLib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{298f32ca-94c4-4808-be02-644b9c7d89cf}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04f63e9df9ee48236ace3c32141b1279_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\TypeLib\ = "{A4E32025-FC62-415F-BF9A-71CA415CA893}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4E32025-FC62-415F-BF9A-71CA415CA893} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EDD68F6-3C14-459B-90C6-9D875CF0A325}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2616 wrote to memory of 4648 2616 regsvr32.exe regsvr32.exe PID 2616 wrote to memory of 4648 2616 regsvr32.exe regsvr32.exe PID 2616 wrote to memory of 4648 2616 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\04f63e9df9ee48236ace3c32141b1279_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\04f63e9df9ee48236ace3c32141b1279_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class