Analysis
-
max time kernel
139s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 14:20
Static task
static1
Behavioral task
behavioral1
Sample
07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
07c574ea5a825f17cf26b600ec849946
-
SHA1
a156670e4e9022f9535ae16ac542248f27b7ed97
-
SHA256
a697447574453fff7e5b82a6c43f4b2790a43ed024827f40ba784a71d6b72d76
-
SHA512
f548496abfcba46358cd28e8777a0261590323f35c49832f6052297734abec105e789007047c10eb0818dc51ae7b9acebf72c7b879a4391501c7bf2b097edabd
-
SSDEEP
24576:Pgx9GxisYespQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jg:ZisYxpg0vxgtqcuABLJ2PiIsROmjbfg4
Malware Config
Extracted
qakbot
402.363
obama109
1633422349
202.134.178.157:443
187.116.124.82:995
73.130.180.25:443
73.52.50.32:443
120.151.47.189:443
181.118.183.94:443
122.11.220.212:2222
103.142.10.177:443
202.165.32.158:2222
70.37.217.196:443
78.191.36.142:995
167.248.100.227:443
103.148.120.144:443
89.101.97.139:443
75.75.179.226:443
120.150.218.241:995
185.250.148.74:443
72.196.22.184:0
81.241.252.59:2078
140.82.49.12:443
136.232.34.70:443
39.52.197.237:995
167.248.117.81:443
81.250.153.227:2222
69.30.186.190:443
73.230.205.91:443
89.137.52.44:443
74.72.237.54:443
96.57.188.174:2078
37.210.152.224:995
94.200.181.154:443
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
115.96.53.68:443
124.123.42.115:2222
38.10.197.234:443
75.66.88.33:443
173.21.10.71:2222
73.151.236.31:443
47.22.148.6:443
173.25.162.221:443
71.74.12.34:443
75.188.35.168:443
206.47.134.234:2222
216.201.162.158:443
67.165.206.193:993
45.46.53.140:2222
76.25.142.196:443
167.248.23.224:443
47.40.196.233:2222
177.94.21.110:995
208.89.170.179:443
167.248.54.34:2222
86.8.177.143:443
181.4.53.6:465
167.248.99.149:443
201.93.111.2:995
24.55.112.61:443
73.77.87.137:443
109.12.111.14:443
181.4.53.6:443
40.131.140.155:995
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
72.252.201.69:443
68.186.192.69:443
24.229.150.54:995
173.25.166.81:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
2.99.100.134:2222
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
24.119.214.7:443
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
174.54.193.186:443
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
24.139.72.117:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
68.204.7.158:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
209.50.20.255:443
97.98.130.50:443
196.117.106.38:995
77.57.204.78:443
191.191.38.8:443
176.251.215.116:443
96.46.103.109:2222
188.210.210.122:443
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
199.27.127.129:443
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
217.165.163.21:995
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Keglh = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Xfozabzli = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4736 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\233caece = 8f2d18d3b640889ceb67e29ffd7a0d4f6318c5957c01b8b4ebb12be927aa09d46a2b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\16a37e80 = 7b81ed45ba286096b4f96c580e34f50067ac3db73a462924f0ad62ab693aea7d3a28e6e4169d9cc51d82862f73a1bd0bba0f4ca0a61e51436e27c1cb0b92df072a9cd20fbea5a5ef3619e546de73b3fee1627918963e01a97ec872c8103f940ceed225bcbb023a3f8b95fe9ed6c081f020ee42828b2cb3a5aee6fbbec8aa129f746c4f2cc19255a549572d02396473323d1a32dadaf4b66bac90b825b0d1123238c82055729f8778d5b5c7e269a235513f6b65245ed519fd3afbcb1b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\14e25efc = 148e31b74f75ea604e85664f2b2208f31f94f761b4f44025631f0658390cdf00a59681002e627e8fa77fb1950a7720f8bd2a7f1b5dea7af763a5d1e804eb27d118a3d7e2442b8647a59c5f1c325ae93925fe044370ffe7840d97 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\69ea1176 = dfb7c45cbcd26ed403c5f598c76be2ca018cf9a9e473e1f51a6b08a5110393e12799b2cd56f9d5a570cd1419b5874a655852b5de3d80f0ceb89cc17caef5a7c34ce1845371c6354bdfaf explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\ae1f19e5 = ff21377442679428bba7f18bd06c22b45e546802d267fcf54299b0fa10ea28691f9ac7d2bcc6c4ada6dcdb85b876da70d61fc5fd333595fb22520c8e4e078b2736ab2a2f2e6abbb46e4f6f9c5b1cec146eaea76bfe34f14e001e7cd7fa731b7bf3c5f93e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\233caece = 8f2d0fd3b640bdcfc686eb9333effa64a86bcd035bf1e8ce0aee092c43fa0d3ec96a4a627794e0c032ec2363d09faa070c5ebbf1f588ab explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\d1567613 = 714e51eb64e5b6c8d0c519e03594eba444d6345e7709e6e3bb782c61501e246be0b2af5343bf3835495a8e7e09a694ff17751c039df1ec11af5a97ff91809c03f45486da71e21eaaeb27c13e4e921d4db205808320a4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\5c75c138 = 1de5ba6b9ab34d653e44c27a1c8dc9c3e7a484d719a875d36b0abcba301a04dff015cfb5f40d8637394c41e88ea8738bb85487d287e0729aed495378119e84d3f71d3af3576b77b553db6b0fa9 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Obxlajcbnisdwe\ac5e3999 = 886263d3c19bdf95a36746e8817b24e55edee0d8d4dbf37d5033533b79abe5fe3e0b531c039c428272801f25735c0c4b3f004ce1e276d824ebe87801846ff0176d018b5f335cad8fe75e49251106d8bc809a758267aab5c5da1fc03ebfcf0bede0aa350894 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 4004 rundll32.exe 4004 rundll32.exe 4736 regsvr32.exe 4736 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 4004 rundll32.exe 4736 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3888 wrote to memory of 4004 3888 rundll32.exe rundll32.exe PID 3888 wrote to memory of 4004 3888 rundll32.exe rundll32.exe PID 3888 wrote to memory of 4004 3888 rundll32.exe rundll32.exe PID 4004 wrote to memory of 388 4004 rundll32.exe explorer.exe PID 4004 wrote to memory of 388 4004 rundll32.exe explorer.exe PID 4004 wrote to memory of 388 4004 rundll32.exe explorer.exe PID 4004 wrote to memory of 388 4004 rundll32.exe explorer.exe PID 4004 wrote to memory of 388 4004 rundll32.exe explorer.exe PID 388 wrote to memory of 404 388 explorer.exe schtasks.exe PID 388 wrote to memory of 404 388 explorer.exe schtasks.exe PID 388 wrote to memory of 404 388 explorer.exe schtasks.exe PID 3588 wrote to memory of 4736 3588 regsvr32.exe regsvr32.exe PID 3588 wrote to memory of 4736 3588 regsvr32.exe regsvr32.exe PID 3588 wrote to memory of 4736 3588 regsvr32.exe regsvr32.exe PID 4736 wrote to memory of 1004 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1004 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1004 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1004 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1004 4736 regsvr32.exe explorer.exe PID 1004 wrote to memory of 1408 1004 explorer.exe reg.exe PID 1004 wrote to memory of 1408 1004 explorer.exe reg.exe PID 1004 wrote to memory of 4580 1004 explorer.exe reg.exe PID 1004 wrote to memory of 4580 1004 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zhfyettnqk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll\"" /SC ONCE /Z /ST 14:22 /ET 14:344⤵
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Keglh" /d "0"4⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xfozabzli" /d "0"4⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\07c574ea5a825f17cf26b600ec849946_JaffaCakes118.dllFilesize
1.0MB
MD507c574ea5a825f17cf26b600ec849946
SHA1a156670e4e9022f9535ae16ac542248f27b7ed97
SHA256a697447574453fff7e5b82a6c43f4b2790a43ed024827f40ba784a71d6b72d76
SHA512f548496abfcba46358cd28e8777a0261590323f35c49832f6052297734abec105e789007047c10eb0818dc51ae7b9acebf72c7b879a4391501c7bf2b097edabd
-
memory/388-5-0x0000000000F70000-0x0000000000F91000-memory.dmpFilesize
132KB
-
memory/388-9-0x0000000000F70000-0x0000000000F91000-memory.dmpFilesize
132KB
-
memory/388-10-0x0000000000F70000-0x0000000000F91000-memory.dmpFilesize
132KB
-
memory/388-11-0x0000000000F70000-0x0000000000F91000-memory.dmpFilesize
132KB
-
memory/388-13-0x0000000000F70000-0x0000000000F91000-memory.dmpFilesize
132KB
-
memory/1004-22-0x0000000000170000-0x0000000000191000-memory.dmpFilesize
132KB
-
memory/1004-28-0x0000000000170000-0x0000000000191000-memory.dmpFilesize
132KB
-
memory/1004-26-0x0000000000170000-0x0000000000191000-memory.dmpFilesize
132KB
-
memory/1004-25-0x0000000000170000-0x0000000000191000-memory.dmpFilesize
132KB
-
memory/1004-24-0x0000000000170000-0x0000000000191000-memory.dmpFilesize
132KB
-
memory/4004-6-0x0000000074860000-0x0000000075275000-memory.dmpFilesize
10.1MB
-
memory/4004-0-0x0000000074860000-0x0000000075275000-memory.dmpFilesize
10.1MB
-
memory/4004-4-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/4004-3-0x0000000074860000-0x0000000075275000-memory.dmpFilesize
10.1MB
-
memory/4736-19-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/4736-18-0x0000000072840000-0x0000000073255000-memory.dmpFilesize
10.1MB
-
memory/4736-21-0x0000000072840000-0x0000000073255000-memory.dmpFilesize
10.1MB
-
memory/4736-17-0x0000000072840000-0x0000000073255000-memory.dmpFilesize
10.1MB