Analysis
- max time kernel
93s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 19:20
Behavioral task
behavioral1
Sample
e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe
Resource
win7-20240319-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe
- Size 87KB
- Sample240407-x2c7ksce26
- SHA256 d46011751dcab027d672562b4f289e6570d68df4ba039f8c2b7c7a16c5eedc2b
- MD5 e5abd9336d54388d2a4e3cfa10527dab
- SHA1 4d95d62fec79d0cc0e2d9c0455ee5cbf90df9a86
- SHA512 e673ccb2970db2deb568abd7ae7b5b87ce12104c6c06eb630e7a9f2f5a9edc1374a51064480e27f9885ddd4971a01331bab1ad7fc0712d5c7f2fabb40756df54
- SSDEEP 1536:3+wzevThAGTcjxWHbnv+Gyz5oj40VWNXX1K4U1L2MxyjZLEbHF8Uo:3+wavThAwc07v+TV8LVKU4U127jZLEbW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,c:\\program files (x86)\\internet explorer\\e5abd9336d54388d2a4e3cfa10527dab_jaffacakes118.exe" e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00060000000231ce-5.dat acprotect - Loads dropped DLL 1 IoCs
pid Process 2636 Regsvr32.exe -
resource yara_rule behavioral2/memory/2284-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2636-6-0x0000000010000000-0x000000001002F000-memory.dmp upx behavioral2/files/0x00060000000231ce-5.dat upx behavioral2/memory/2284-10-0x0000000000400000-0x000000000040F000-memory.dmp upx - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9} Regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\NoExplorer = "1" Regsvr32.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wybho.dll e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\internet explorer\e5abd9336d54388d2a4e3cfa10527dab_jaffacakes118.exe e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool\CurVer\ = "WYBHO.wybhotool.1" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\wybho.dll" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\ = "Iwybhotool" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool.1\ = "wybhotool Class" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\Programmable Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\FLAGS Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\ProxyStubClsid32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool.1\CLSID\ = "{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\ = "wybhotool Class" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\TypeLib\ = "{33B67EF7-9400-48FC-A75F-0351ADB43896}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\TypeLib\Version = "1.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool\CLSID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\VersionIndependentProgID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\ = "WYBHO 1.0 Type Library" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\HELPDIR Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\HELPDIR\ = "C:\\Windows\\system32" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\ProxyStubClsid32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\TypeLib\Version = "1.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\InprocServer32 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool.1\CLSID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool\CurVer Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\ProgID\ = "WYBHO.wybhotool.1" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\VersionIndependentProgID\ = "WYBHO.wybhotool" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\0\win32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\ = "Iwybhotool" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool.1 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool\ = "wybhotool Class" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\TypeLib\ = "{33B67EF7-9400-48FC-A75F-0351ADB43896}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\FLAGS\ = "0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{33B67EF7-9400-48FC-A75F-0351ADB43896}\1.0\0 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B25C165-EA92-4466-95B1-BE7CC053DAAA}\TypeLib\ = "{33B67EF7-9400-48FC-A75F-0351ADB43896}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYBHO.wybhotool\CLSID\ = "{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98D7F442-A617-4238-BBC4-AF8AD4F38DC9}\InprocServer32\ = "C:\\Windows\\SysWow64\\wybho.dll" Regsvr32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2636 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 85 PID 2284 wrote to memory of 2636 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 85 PID 2284 wrote to memory of 2636 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 85 PID 2284 wrote to memory of 4704 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 90 PID 2284 wrote to memory of 4704 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 90 PID 2284 wrote to memory of 4704 2284 e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5abd9336d54388d2a4e3cfa10527dab_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe /s "C:\Windows\system32\wybho.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\123.bat2⤵PID:4704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\123.bat
- Size 280B
- SHA256 dd7f2a8a7a415de1ba770fda425ce5ad816b1ddc8ffd5abb2fd4d4c3aef4415d
- MD5 1a3c502ec7766f64dea696b637fbc1d7
- SHA1 633774c40af5a3c337e7b99e7b45f5077de7d2d9
- SHA512 65c778d17c3b78e6ace80510e3bfd96d0373d3b0e746930a5d95bb9ad8f33a170e8c1caad885a8f7cb2c38330ddbab24ef0863c823d7d7ef092a75e25b5afc15
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wybho.dll
- Size 70KB
- SHA256 67ce25a41e636290d8fb9217682b1e91c0026cb2361526d5cad40f2f6265f718
- MD5 49cffbe17949983dd6c9f5c62628a45d
- SHA1 0c81e893c55d79289a4656c73e07b19eac07b17e
- SHA512 570fa009131c02e7ff36fbe42a555f0ab8f59730571c16482182311a65a1e2bffed352244b7722a3babd7f58db71a22f70868799bbd69c9b8ed258e992b2f1be
- SSDEEP 1536:ATcjxWHbnv+Gyz5oj40VWNXX1K4U1L2MxyjZLEbHF8UQ:6c07v+TV8LVKU4U127jZLEbHFHQ
- MD5 SHA1 SHA512 SSDEEP