Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 14:20
Static task
static1
Behavioral task
behavioral1
Sample
07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
07c574ea5a825f17cf26b600ec849946
-
SHA1
a156670e4e9022f9535ae16ac542248f27b7ed97
-
SHA256
a697447574453fff7e5b82a6c43f4b2790a43ed024827f40ba784a71d6b72d76
-
SHA512
f548496abfcba46358cd28e8777a0261590323f35c49832f6052297734abec105e789007047c10eb0818dc51ae7b9acebf72c7b879a4391501c7bf2b097edabd
-
SSDEEP
24576:Pgx9GxisYespQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jg:ZisYxpg0vxgtqcuABLJ2PiIsROmjbfg4
Malware Config
Extracted
qakbot
402.363
obama109
1633422349
202.134.178.157:443
187.116.124.82:995
73.130.180.25:443
73.52.50.32:443
120.151.47.189:443
181.118.183.94:443
122.11.220.212:2222
103.142.10.177:443
202.165.32.158:2222
70.37.217.196:443
78.191.36.142:995
167.248.100.227:443
103.148.120.144:443
89.101.97.139:443
75.75.179.226:443
120.150.218.241:995
185.250.148.74:443
72.196.22.184:0
81.241.252.59:2078
140.82.49.12:443
136.232.34.70:443
39.52.197.237:995
167.248.117.81:443
81.250.153.227:2222
69.30.186.190:443
73.230.205.91:443
89.137.52.44:443
74.72.237.54:443
96.57.188.174:2078
37.210.152.224:995
94.200.181.154:443
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
115.96.53.68:443
124.123.42.115:2222
38.10.197.234:443
75.66.88.33:443
173.21.10.71:2222
73.151.236.31:443
47.22.148.6:443
173.25.162.221:443
71.74.12.34:443
75.188.35.168:443
206.47.134.234:2222
216.201.162.158:443
67.165.206.193:993
45.46.53.140:2222
76.25.142.196:443
167.248.23.224:443
47.40.196.233:2222
177.94.21.110:995
208.89.170.179:443
167.248.54.34:2222
86.8.177.143:443
181.4.53.6:465
167.248.99.149:443
201.93.111.2:995
24.55.112.61:443
73.77.87.137:443
109.12.111.14:443
181.4.53.6:443
40.131.140.155:995
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
72.252.201.69:443
68.186.192.69:443
24.229.150.54:995
173.25.166.81:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
2.99.100.134:2222
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
24.119.214.7:443
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
174.54.193.186:443
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
24.139.72.117:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
68.204.7.158:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
209.50.20.255:443
97.98.130.50:443
196.117.106.38:995
77.57.204.78:443
191.191.38.8:443
176.251.215.116:443
96.46.103.109:2222
188.210.210.122:443
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
199.27.127.129:443
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
217.165.163.21:995
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Rkaqprkowjuy = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Goyqnoqjcl = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1960 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Iwwgwpajulxiu explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\c8508fa4 = b2a0e529c9d9c8ed8b5d5a280633bd62682a81e815e12744949de778a652673b15a93f1a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\3a3a5779 = 09a701a9d7ea911ef0b64fd98e01 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\4573388f = b5b33b7e5be627e535e59049013161ee8483031dda695b7229e2f0ff778d95cbcc1399e13f144fb70ed3cd338661305b26a052bc2c7b25ff68aa114b68cce7b73d7b9456 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\4573388f = b5b32c7e5be6121a121cab95ee7182f0663300b37d16ec6beb31dcc6cf3c1efeffeb007f9d290ed8df79f4a9378e30 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\70ece8c1 = 699f87e8447c0739a57aab4ae6453f64435bd59be510a47f6472b9d1c41391d181ec0a5facefc52b126eae3ab90603f2af55dd9640e32c13be95adfebc4e56c0241bca76f1dce0f3cc345252acab4b4d6c1344ac637a0b8fba8dcf304660bc2ec5144d8e1f3ce4fb5de576e5870b7ad61dd49cc3501e390d93b8fd07cde82f07ab0b086b82fe752b1801d47a1407462bb20f29d353d8203bc0dda1b01bea explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\72adc8bd = b6f6e8a9c053a776758a6dd7475bc5e2edb886b19e9170c94596a88f75139012cfbdeb706ba4356346fd778bb26e9a7c8685cc1c555a79bd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\ca11afd8 = e787a59fbd95cb659fd72dc6d82ca8bcb3fe51e8932ac8fc4bccd417e3d5216682c096ac0e781bd0d0d8c30700fea2ebeee266fb1b2cc8aacdfc3bb007f07ee4bb8a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\b719e052 = 0efde1affa98f4be263168371693b86eaa38d557511589218bb2bbe15c5a982dc0f301ae09b5afc7c71efc1e828ebf74fd384f8b31 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iwwgwpajulxiu\fa58737 = 409c189d7fb9a7f7c599c8df4e143e7fdfb4baa2cc18edcaa63fd3862a23d2b8ac75427c14addeb3b2f70641 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1284 rundll32.exe 1960 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1284 rundll32.exe 1960 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1284 2040 rundll32.exe rundll32.exe PID 1284 wrote to memory of 2560 1284 rundll32.exe explorer.exe PID 1284 wrote to memory of 2560 1284 rundll32.exe explorer.exe PID 1284 wrote to memory of 2560 1284 rundll32.exe explorer.exe PID 1284 wrote to memory of 2560 1284 rundll32.exe explorer.exe PID 1284 wrote to memory of 2560 1284 rundll32.exe explorer.exe PID 1284 wrote to memory of 2560 1284 rundll32.exe explorer.exe PID 2560 wrote to memory of 2516 2560 explorer.exe schtasks.exe PID 2560 wrote to memory of 2516 2560 explorer.exe schtasks.exe PID 2560 wrote to memory of 2516 2560 explorer.exe schtasks.exe PID 2560 wrote to memory of 2516 2560 explorer.exe schtasks.exe PID 272 wrote to memory of 2332 272 taskeng.exe regsvr32.exe PID 272 wrote to memory of 2332 272 taskeng.exe regsvr32.exe PID 272 wrote to memory of 2332 272 taskeng.exe regsvr32.exe PID 272 wrote to memory of 2332 272 taskeng.exe regsvr32.exe PID 272 wrote to memory of 2332 272 taskeng.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 2332 wrote to memory of 1960 2332 regsvr32.exe regsvr32.exe PID 1960 wrote to memory of 872 1960 regsvr32.exe explorer.exe PID 1960 wrote to memory of 872 1960 regsvr32.exe explorer.exe PID 1960 wrote to memory of 872 1960 regsvr32.exe explorer.exe PID 1960 wrote to memory of 872 1960 regsvr32.exe explorer.exe PID 1960 wrote to memory of 872 1960 regsvr32.exe explorer.exe PID 1960 wrote to memory of 872 1960 regsvr32.exe explorer.exe PID 872 wrote to memory of 1360 872 explorer.exe reg.exe PID 872 wrote to memory of 1360 872 explorer.exe reg.exe PID 872 wrote to memory of 1360 872 explorer.exe reg.exe PID 872 wrote to memory of 1360 872 explorer.exe reg.exe PID 872 wrote to memory of 2136 872 explorer.exe reg.exe PID 872 wrote to memory of 2136 872 explorer.exe reg.exe PID 872 wrote to memory of 2136 872 explorer.exe reg.exe PID 872 wrote to memory of 2136 872 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rxwhbjn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll\"" /SC ONCE /Z /ST 14:22 /ET 14:344⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {B6E13A70-0ED6-4220-9634-BA636B480EFC} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Rkaqprkowjuy" /d "0"5⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Goyqnoqjcl" /d "0"5⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dllFilesize
1.0MB
MD507c574ea5a825f17cf26b600ec849946
SHA1a156670e4e9022f9535ae16ac542248f27b7ed97
SHA256a697447574453fff7e5b82a6c43f4b2790a43ed024827f40ba784a71d6b72d76
SHA512f548496abfcba46358cd28e8777a0261590323f35c49832f6052297734abec105e789007047c10eb0818dc51ae7b9acebf72c7b879a4391501c7bf2b097edabd
-
memory/872-32-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/872-29-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/872-30-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/872-28-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/872-25-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/1284-8-0x00000000732F0000-0x0000000073D05000-memory.dmpFilesize
10.1MB
-
memory/1284-0-0x00000000732F0000-0x0000000073D05000-memory.dmpFilesize
10.1MB
-
memory/1284-1-0x00000000732F0000-0x0000000073D05000-memory.dmpFilesize
10.1MB
-
memory/1284-3-0x00000000732F0000-0x0000000073D05000-memory.dmpFilesize
10.1MB
-
memory/1284-4-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1960-26-0x00000000728D0000-0x00000000732E5000-memory.dmpFilesize
10.1MB
-
memory/1960-20-0x00000000728D0000-0x00000000732E5000-memory.dmpFilesize
10.1MB
-
memory/1960-21-0x00000000728D0000-0x00000000732E5000-memory.dmpFilesize
10.1MB
-
memory/1960-23-0x00000000728D0000-0x00000000732E5000-memory.dmpFilesize
10.1MB
-
memory/2560-7-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2560-11-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2560-5-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/2560-15-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2560-13-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2560-12-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB