Analysis
-
max time kernel
157s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 05:04
Static task
static1
Behavioral task
behavioral1
Sample
dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll
-
Size
905KB
-
MD5
dbf66cf845c6af2445cb611215c84282
-
SHA1
ae1c4b5d117e57bf8d541edab0e0bd100db07ea1
-
SHA256
7cd8216e129493641bbe7f573b13425bcf52923bad83ee532abd66fed293d9fc
-
SHA512
300c569c6221b7d24ecee114d9cee1a7f9f6873de2ba21cf41f115f2e456a81b7348b584c1d5c442b5bfa3624538f16e3f9e7f756158a302f12187f657c984b7
-
SSDEEP
12288:dU7AzcO18OcZtc98uEE8aPfR6xa7jg0Ii3pSGdSJbbIclZg5i0WBRLuMdgX2rbnj:GAzcO1T0yfR6lxcYIYZDqM9n7Bn
Malware Config
Extracted
qakbot
402.363
obama116
1634289383
41.228.22.180:443
188.55.249.239:995
120.150.218.241:995
37.117.191.19:2222
68.204.7.158:443
81.241.252.59:2078
196.207.140.40:995
174.54.193.186:443
63.143.92.99:995
197.89.144.200:443
86.220.112.26:2222
73.52.50.32:443
103.82.211.39:465
146.66.238.74:443
167.248.117.81:443
2.222.167.138:443
181.118.183.94:443
103.82.211.39:995
78.179.137.102:995
89.137.52.44:443
189.152.1.4:80
217.17.56.163:465
174.76.17.43:443
98.203.26.168:443
213.60.210.85:443
199.27.127.129:443
93.48.58.123:2222
81.250.153.227:2222
37.210.152.224:995
65.100.174.110:995
91.178.126.51:995
72.173.78.211:443
94.200.181.154:443
176.45.11.226:443
136.232.34.70:443
220.255.25.28:2222
27.223.92.142:995
208.78.220.143:443
76.25.142.196:443
213.205.242.210:995
65.100.174.110:443
140.82.49.12:443
216.201.162.158:443
39.49.32.238:995
24.231.209.2:2222
65.100.174.110:6881
69.30.186.190:443
41.86.42.158:995
187.75.66.160:995
68.186.192.69:443
73.151.236.31:443
71.74.12.34:443
122.60.71.201:995
75.188.35.168:443
173.22.178.66:443
189.135.16.92:443
173.21.10.71:2222
45.46.53.140:2222
187.156.169.68:443
105.198.236.99:443
65.100.174.110:8443
189.146.41.71:443
181.4.53.6:465
47.40.196.233:2222
72.252.201.69:995
67.165.206.193:993
189.147.159.42:443
50.194.160.233:32100
50.194.160.233:465
89.101.97.139:443
24.139.72.117:443
24.229.150.54:995
24.55.112.61:443
2.221.12.60:443
201.68.60.118:995
50.194.160.233:995
109.12.111.14:443
77.57.204.78:443
65.100.174.110:32103
123.201.44.86:6881
177.76.251.27:995
103.142.10.177:443
136.143.11.232:443
136.232.254.46:995
67.230.44.194:443
109.200.192.84:443
73.230.205.91:443
24.119.214.7:443
49.206.29.127:443
103.148.120.144:443
189.252.218.40:32101
136.232.254.46:443
95.159.33.115:995
115.96.62.113:443
96.37.113.36:993
85.60.147.26:2078
75.131.217.182:443
85.60.147.26:2222
39.52.209.173:995
129.35.116.77:990
68.117.229.117:443
83.110.201.195:443
80.6.192.58:443
103.250.38.115:443
117.198.158.234:443
185.250.148.74:443
82.43.184.158:443
111.125.245.116:443
124.123.42.115:2222
189.252.166.130:32101
103.82.211.39:993
82.178.55.68:443
187.149.255.245:443
72.252.32.47:443
24.231.209.2:8443
105.242.94.246:995
24.231.209.2:50000
24.231.209.2:1194
24.107.165.50:443
50.194.160.233:993
50.194.160.233:22
24.231.209.2:2083
24.231.209.2:2087
24.231.209.2:2078
24.231.209.2:6881
39.49.64.244:995
24.231.209.2:50001
24.231.209.2:32100
50.194.160.233:443
123.201.40.112:443
120.151.47.189:443
86.152.43.223:443
67.166.233.75:443
122.11.222.242:2222
187.250.159.104:443
75.66.88.33:443
73.77.87.137:443
66.216.193.114:443
96.57.188.174:2078
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Afmykhuiq = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Iflhqc = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 580 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\d1ad1585 = 05a898ff3bfa50f98d1d0de92ff20396c490ab4838dbb12f017fcd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\23c7cd58 = 18777b2dbc067ad7e2ae70c17dcf73bd92efca9aadb9af0a2f490c5125edd71baf58aa1f9d8d22fe9da19990c163df348ed64a355f8bf89b0fa4c4ba9e9df9c829d1b848c89c50b2d5d3755578 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\9b7baa3d = 15e26d7109a08ecad71e35a694049091098d188ca200093fb8c84cf1e9223176efbde14d8be8392ad1e897cc2f0a7f8df003e6fa8a00d441d6daf2263e5e429d4d6b4d8d91e94770b23f6e797f449aca49da3d2d2cc76491a13f4fb854a18c34107c28074fd2e65863da35a55cf2b5d90288 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Aejosvmsldxb explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\e673e5b7 = 42650339a0bb4d8660601cb911526efe5d83045632e061bbde6a0dc4b2bb5f71a4a44e29e7518c0a3c73c3dc6043ba90fbfa46387c6dfe550e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\5ecf82d2 = 0bb945ba45fed81c41007069324c65402a496a21bdcf43dd01e45b0616f62d02473657a3fe8f9c055a280a9d7e21ab16d44753c3879b501622daa156b19ff3004c4c5a97f5697d05665799063d4a403295ab46 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\5c8ea2ae = fae58724db3aae1a3747c912e463a7ce9e4222aa350ff4a8ce73fa3dac192d explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\aee47a73 = 76e8bfb693fa83d863619535b982bca7f26831b5d0aa4e9f900ea717af9a34d3c37467c223abbc156d69489f2f579212a95cf3d05a4439bd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\d1ad1585 = 05a88fff3bfa6574f8c5aa70b8447e19a62dde6e9f26cfb8bc63c49f1262d523c6ef4b1a343f4eeb4f87eda97ad3351a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aejosvmsldxb\e432c5cb = 33a5a9cab156661a31aa5299eca10f4a18571e01bfd394eee7f0f491e555f7ab6f895e46164c2ff3c737322c57a27bf1537fd80e333367d61b0f9a7534f9c967f21f77dcbdfbc4a123fd08c46854d661f0088a55a6dcf5115ac58eba565f3ac823a52b2555b64007e3abe944a8dc6088d0ab5e6c7fa14a6fbb8f4642f705291f25fe40074647e8ce257eabdb2ba1ae3ecbfcbac9e85ac7ea9b8c20fe3769 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2560 rundll32.exe 580 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2560 rundll32.exe 580 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2952 wrote to memory of 2560 2952 rundll32.exe rundll32.exe PID 2560 wrote to memory of 2548 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 2548 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 2548 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 2548 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 2548 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 2548 2560 rundll32.exe explorer.exe PID 2548 wrote to memory of 2552 2548 explorer.exe schtasks.exe PID 2548 wrote to memory of 2552 2548 explorer.exe schtasks.exe PID 2548 wrote to memory of 2552 2548 explorer.exe schtasks.exe PID 2548 wrote to memory of 2552 2548 explorer.exe schtasks.exe PID 1872 wrote to memory of 484 1872 taskeng.exe regsvr32.exe PID 1872 wrote to memory of 484 1872 taskeng.exe regsvr32.exe PID 1872 wrote to memory of 484 1872 taskeng.exe regsvr32.exe PID 1872 wrote to memory of 484 1872 taskeng.exe regsvr32.exe PID 1872 wrote to memory of 484 1872 taskeng.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 484 wrote to memory of 580 484 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1180 580 regsvr32.exe explorer.exe PID 580 wrote to memory of 1180 580 regsvr32.exe explorer.exe PID 580 wrote to memory of 1180 580 regsvr32.exe explorer.exe PID 580 wrote to memory of 1180 580 regsvr32.exe explorer.exe PID 580 wrote to memory of 1180 580 regsvr32.exe explorer.exe PID 580 wrote to memory of 1180 580 regsvr32.exe explorer.exe PID 1180 wrote to memory of 2272 1180 explorer.exe reg.exe PID 1180 wrote to memory of 2272 1180 explorer.exe reg.exe PID 1180 wrote to memory of 2272 1180 explorer.exe reg.exe PID 1180 wrote to memory of 2272 1180 explorer.exe reg.exe PID 1180 wrote to memory of 1116 1180 explorer.exe reg.exe PID 1180 wrote to memory of 1116 1180 explorer.exe reg.exe PID 1180 wrote to memory of 1116 1180 explorer.exe reg.exe PID 1180 wrote to memory of 1116 1180 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn etqbjtff /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll\"" /SC ONCE /Z /ST 05:07 /ET 05:194⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {4781009D-53F9-4985-8066-68A8BA763FAB} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Afmykhuiq" /d "0"5⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iflhqc" /d "0"5⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dbf66cf845c6af2445cb611215c84282_JaffaCakes118.dllFilesize
905KB
MD5dbf66cf845c6af2445cb611215c84282
SHA1ae1c4b5d117e57bf8d541edab0e0bd100db07ea1
SHA2567cd8216e129493641bbe7f573b13425bcf52923bad83ee532abd66fed293d9fc
SHA512300c569c6221b7d24ecee114d9cee1a7f9f6873de2ba21cf41f115f2e456a81b7348b584c1d5c442b5bfa3624538f16e3f9e7f756158a302f12187f657c984b7
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/580-27-0x0000000074390000-0x0000000074515000-memory.dmpFilesize
1.5MB
-
memory/580-21-0x0000000074390000-0x0000000074515000-memory.dmpFilesize
1.5MB
-
memory/580-22-0x0000000074390000-0x0000000074515000-memory.dmpFilesize
1.5MB
-
memory/580-20-0x0000000074390000-0x0000000074515000-memory.dmpFilesize
1.5MB
-
memory/1180-33-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1180-31-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1180-30-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1180-29-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1180-26-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-7-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-15-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-14-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-13-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-12-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-11-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/2548-5-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/2560-8-0x0000000074B40000-0x0000000074CC5000-memory.dmpFilesize
1.5MB
-
memory/2560-0-0x0000000074B40000-0x0000000074CC5000-memory.dmpFilesize
1.5MB
-
memory/2560-1-0x0000000074B40000-0x0000000074CC5000-memory.dmpFilesize
1.5MB
-
memory/2560-4-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2560-2-0x0000000074B40000-0x0000000074CC5000-memory.dmpFilesize
1.5MB