Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 10:42
Static task
static1
Behavioral task
behavioral1
Sample
d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll
Resource
win7-20231129-en
General
-
Target
d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
d17ec527b31770a3a52c6137945f4258
-
SHA1
58b53498733d60b641531dc5dac747ce1bdd1cdd
-
SHA256
18640f63b12da166a38cfe0bb20ae8d9bc658c403e87d6e873d9900e90da5b01
-
SHA512
16442dd6cfff68332dec413b4b7bc1316390405614ffeb396c0c37e3a64fb7e859402bc42806bf064785042c9785d21108bdc959c5cae4746be5c058f37826f2
-
SSDEEP
24576:+g/9GxisYespQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jgo:+isYxpg0vxgtqcuABLJ2PiIsROmjbfgN
Malware Config
Extracted
qakbot
402.363
obama109
1633422349
202.134.178.157:443
187.116.124.82:995
73.130.180.25:443
73.52.50.32:443
120.151.47.189:443
181.118.183.94:443
122.11.220.212:2222
103.142.10.177:443
202.165.32.158:2222
70.37.217.196:443
78.191.36.142:995
167.248.100.227:443
103.148.120.144:443
89.101.97.139:443
75.75.179.226:443
120.150.218.241:995
185.250.148.74:443
72.196.22.184:0
81.241.252.59:2078
140.82.49.12:443
136.232.34.70:443
39.52.197.237:995
167.248.117.81:443
81.250.153.227:2222
69.30.186.190:443
73.230.205.91:443
89.137.52.44:443
74.72.237.54:443
96.57.188.174:2078
37.210.152.224:995
94.200.181.154:443
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
115.96.53.68:443
124.123.42.115:2222
38.10.197.234:443
75.66.88.33:443
173.21.10.71:2222
73.151.236.31:443
47.22.148.6:443
173.25.162.221:443
71.74.12.34:443
75.188.35.168:443
206.47.134.234:2222
216.201.162.158:443
67.165.206.193:993
45.46.53.140:2222
76.25.142.196:443
167.248.23.224:443
47.40.196.233:2222
177.94.21.110:995
208.89.170.179:443
167.248.54.34:2222
86.8.177.143:443
181.4.53.6:465
167.248.99.149:443
201.93.111.2:995
24.55.112.61:443
73.77.87.137:443
109.12.111.14:443
181.4.53.6:443
40.131.140.155:995
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
72.252.201.69:443
68.186.192.69:443
24.229.150.54:995
173.25.166.81:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
2.99.100.134:2222
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
24.119.214.7:443
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
174.54.193.186:443
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
24.139.72.117:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
68.204.7.158:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
209.50.20.255:443
97.98.130.50:443
196.117.106.38:995
77.57.204.78:443
191.191.38.8:443
176.251.215.116:443
96.46.103.109:2222
188.210.210.122:443
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
199.27.127.129:443
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
217.165.163.21:995
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Egfwi = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ycuibyoyioz = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 5036 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\ea11a0f6 = dae06c82d74a4e679d2423e47665189fc98a3803ca0fbdeca30702028d40de12dce58dbaff6a540b6d38ee1790d4fb77b6b4cb2ab09473a080981b53578aef1c74257ee4a0367e63a18366da8614baef71419e98c9824202671b40d77fd37046f18f0d4f599f84f6674da6b763dacdf61a47659935715b97a76a7e2b8001b8d891aa93cdec940c8adebeed9abe6f19f8e22d0ba1165dec7f6b8f4d03e5aca0f233b4e41e5cd7b85c43af713cfad2e998120e37bf903efe27ba explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\50ece7ef = 28ff0aabdd0931a92620816b135d0736d0921a45bff84fcb18e8a88244378909b90f6e85a3daf6ae5ce376fcc8c041c1bca8c0ef0f64d3c938c66609c78d723a7787 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\9558cf00 = b4359e93f43a47d7950c0c68b5d9296da4d4d1c7b307012335cea99ed4301cc715adc1870bfba69561b088dfcba92f9cc1b44ada1447d2434a520737dc9bb24a4e062f7f35144307 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\52adc793 = 1b984994748b0c45685e57391f19c6c5099651de933c8917b6905230d2f6077ad7bd57424bfd6d74 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\a0c71f4e = af1ee1476be8738e7542e8ae479efd14d746d65987eb7f000c8bc5f2b3989de4ab01a4466e027836ccd00c7b5e8cc04ccf736e63bb8f0d4c8b55ca4924768d016333843bb7ab0e99d3937b80035d6815a23861d2b6a2b4b6d0c9582f04f9e1b5 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\df8e70b8 = a43ede403b6a4448a30ffd782b5541c15fa0e26618f8d80d94787726f4973c27977d4e9ab21f5843f6d232980c explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\e850808a = e4864a332f44a24c7fb4d39583bed94da18f264e99ce4d705a30b3d1952555a41051a628 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\2de4a865 = c78fd70e290de561341caea2d92dfbe131b51e77 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xtyrfnrwsq\df8e70b8 = a43ec9403b6a7162837018624d9bd918b201fb5eb1ef908edc2080b70dbf96e712947dcd420c48536656b5f7525bfaf6f6f3cd7e212eed0c01170790800bf9a124df explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2972 rundll32.exe 2972 rundll32.exe 5036 regsvr32.exe 5036 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2972 rundll32.exe 5036 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1624 wrote to memory of 2972 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 2972 1624 rundll32.exe rundll32.exe PID 1624 wrote to memory of 2972 1624 rundll32.exe rundll32.exe PID 2972 wrote to memory of 860 2972 rundll32.exe explorer.exe PID 2972 wrote to memory of 860 2972 rundll32.exe explorer.exe PID 2972 wrote to memory of 860 2972 rundll32.exe explorer.exe PID 2972 wrote to memory of 860 2972 rundll32.exe explorer.exe PID 2972 wrote to memory of 860 2972 rundll32.exe explorer.exe PID 860 wrote to memory of 4732 860 explorer.exe schtasks.exe PID 860 wrote to memory of 4732 860 explorer.exe schtasks.exe PID 860 wrote to memory of 4732 860 explorer.exe schtasks.exe PID 2120 wrote to memory of 5036 2120 regsvr32.exe regsvr32.exe PID 2120 wrote to memory of 5036 2120 regsvr32.exe regsvr32.exe PID 2120 wrote to memory of 5036 2120 regsvr32.exe regsvr32.exe PID 5036 wrote to memory of 4328 5036 regsvr32.exe explorer.exe PID 5036 wrote to memory of 4328 5036 regsvr32.exe explorer.exe PID 5036 wrote to memory of 4328 5036 regsvr32.exe explorer.exe PID 5036 wrote to memory of 4328 5036 regsvr32.exe explorer.exe PID 5036 wrote to memory of 4328 5036 regsvr32.exe explorer.exe PID 4328 wrote to memory of 532 4328 explorer.exe reg.exe PID 4328 wrote to memory of 532 4328 explorer.exe reg.exe PID 4328 wrote to memory of 4060 4328 explorer.exe reg.exe PID 4328 wrote to memory of 4060 4328 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cveeijsjr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll\"" /SC ONCE /Z /ST 10:45 /ET 10:574⤵
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Egfwi" /d "0"4⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ycuibyoyioz" /d "0"4⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d17ec527b31770a3a52c6137945f4258_JaffaCakes118.dllFilesize
1.0MB
MD5d17ec527b31770a3a52c6137945f4258
SHA158b53498733d60b641531dc5dac747ce1bdd1cdd
SHA25618640f63b12da166a38cfe0bb20ae8d9bc658c403e87d6e873d9900e90da5b01
SHA51216442dd6cfff68332dec413b4b7bc1316390405614ffeb396c0c37e3a64fb7e859402bc42806bf064785042c9785d21108bdc959c5cae4746be5c058f37826f2
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/860-13-0x0000000001660000-0x0000000001681000-memory.dmpFilesize
132KB
-
memory/860-5-0x0000000001660000-0x0000000001681000-memory.dmpFilesize
132KB
-
memory/860-9-0x0000000001660000-0x0000000001681000-memory.dmpFilesize
132KB
-
memory/860-10-0x0000000001660000-0x0000000001681000-memory.dmpFilesize
132KB
-
memory/860-11-0x0000000001660000-0x0000000001681000-memory.dmpFilesize
132KB
-
memory/2972-0-0x00000000740F0000-0x0000000074B05000-memory.dmpFilesize
10.1MB
-
memory/2972-6-0x00000000740F0000-0x0000000074B05000-memory.dmpFilesize
10.1MB
-
memory/2972-4-0x0000000002AF0000-0x0000000002AF1000-memory.dmpFilesize
4KB
-
memory/2972-1-0x00000000740F0000-0x0000000074B05000-memory.dmpFilesize
10.1MB
-
memory/2972-2-0x00000000740F0000-0x0000000074B05000-memory.dmpFilesize
10.1MB
-
memory/4328-27-0x0000000000140000-0x0000000000161000-memory.dmpFilesize
132KB
-
memory/4328-21-0x0000000000140000-0x0000000000161000-memory.dmpFilesize
132KB
-
memory/4328-25-0x0000000000140000-0x0000000000161000-memory.dmpFilesize
132KB
-
memory/4328-26-0x0000000000140000-0x0000000000161000-memory.dmpFilesize
132KB
-
memory/5036-19-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/5036-17-0x00000000720D0000-0x0000000072AE5000-memory.dmpFilesize
10.1MB
-
memory/5036-23-0x00000000720D0000-0x0000000072AE5000-memory.dmpFilesize
10.1MB
-
memory/5036-18-0x00000000720D0000-0x0000000072AE5000-memory.dmpFilesize
10.1MB