Analysis
- max time kernel
92s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/04/2024, 10:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe
- Size 198KB
- Sample240409-mp3llach53
- SHA256 7dd668c6dbd0c6bb3ed450f7ac2abb8e0030b53ef92a07af2b1a0a14cbc6e358
- MD5 e9cd2656eb4f91edd1bb125866abff70
- SHA1 4ed224f7d7aab46fa1d64380adecb33133a48423
- SHA512 c9d55e681f85b934cf2b1ded530dec89dafa4ddbeeda35c02d865d0614f88628080127755623bf8b53fc6e2f0ef2824df246c5e82dc09e68ad3de069718ce1da
- SSDEEP 3072:ry+mrh42ya4kcFoWZHlWzzXGOJlBpPlPlUCdWuh+7dUcRBrp:rSrh42xcTHlrMXRlPX+7dt
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\Windows\\system32\\ctfmon_lr.exe" regsvr32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe - Loads dropped DLL 1 IoCs
pid Process 3564 regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{254966F0-1D8E-3361-8373-544B0031109F} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{254966F0-1D8E-3361-8373-544B0031109F}\IExplore = "1" regsvr32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dq71339.dll e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe File created C:\Windows\SysWOW64\ctfmon_lr.exe regsvr32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\InprocServer32\ = "C:\\Windows\\SysWow64\\dq71339.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\ = "LIB" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\VersionIndependentProgID\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{254966F0-1D8E-3361-8373-544B0031109F}\ProgID\ = "D.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\dq71339.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{254966F0-1D8E-3361-8373-544B0031109F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\TypeLib\ = "{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{254966F0-1D8E-3361-8373-544B0031109F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1}\TypeLib\ = "{5B7B8882-6BEE-35FE-BF94-A0CA40FF7296}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1D374C8-FA47-3340-B267-1A7159299DF1} regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2296 wrote to memory of 3564 2296 e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe 96 PID 2296 wrote to memory of 3564 2296 e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe 96 PID 2296 wrote to memory of 3564 2296 e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9cd2656eb4f91edd1bb125866abff70_JaffaCakes118.exe"1⤵
- Sets file execution options in registry
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\dq71339.dll2⤵
- Sets file execution options in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
PID:3564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\dq71339.dll
- Size 192KB
- SHA256 5fb9878df9999e9e71a7e9a95af1271ab39d784c7b3ea08d57c9e85e62ae6023
- MD5 96d96e23224a61d58435c5afa5ffcaee
- SHA1 180a5a2a62b4e757070f436d147cb1fedc11951d
- SHA512 2b75300ef071dc705fb939d7091ead9e5e49bd3654a7ddfb713acb3beb74ff6f31632eaf23ffe3ea4e819de69cc6e3097b08872a4d0dcc36bb5aaadd5906521c
- SSDEEP 3072:e+mrh42ya4kcFoWZHlWzzXGOJlBpPlPlUCdWuh+7dUcRBrp:2rh42xcTHlrMXRlPX+7dt
- MD5 SHA1 SHA512 SSDEEP