Overview
overview
7Static
static
3ed0601de9d...18.exe
windows7-x64
7ed0601de9d...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$_2_/$R0.dll
windows7-x64
6$_2_/$R0.dll
windows10-2004-x64
6$_2_/$R2/N...4_.exe
windows7-x64
1$_2_/$R2/N...4_.exe
windows10-2004-x64
1Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/04/2024, 08:46
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$_2_/$R0.dll
Resource
win7-20240319-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
$_2_/$R0.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe
- Size 116KB
- Sample240411-kpdlcsbb2t
- SHA256 e802660af8ef63ea2dfdc796c151e5676f5dee45666f7fe8133eca22361886d4
- MD5 ed0601de9daaf2befcc7d488324c2b39
- SHA1 c17cd422200cb197cea4c6df63e994f174cbdc24
- SHA512 d44ff0dc6175128903a87cd9885ee613ca1e901021739765504984058b97c251374cd7f93d77c89c1dc6c876e8467684c335d35b335ed94e6a3b876d71d10967
- SSDEEP 1536:VtYuscB6qhtBu/HMDHmJd4Romu/fduJ82U/gsB4VyfYZZdMQeMB8EHDPNW1aaz:VKQXtg/sDHmJd45Sd41UIsOX7zmYlu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 4160 regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system.ini regsvr32.exe File opened for modification C:\Windows\sony\baiduc.dll regsvr32.exe File opened for modification C:\Windows\sony\baiduc.dll ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe File created C:\Windows\sony\baiduc.dll ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe File opened for modification C:\Windows\system.ini ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\ = "Info cache" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{285AB8C5-FB22-4D17-8834-064E2BA0A6F0}" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\ = "Pbtoo2s 1.0 Type Library" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR\ = "C:\\Windows\\sony" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\ = "Info cache" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ThreadingModel = "Apartment" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ = "C:\\Windows\\sony\\baiduc.dll" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32\ = "C:\\Windows\\sony\\baiduc.dll" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ = "C:\\Windows\\sony\\baiduc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0} ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS\ = "0" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{285AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4160 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 91 PID 3372 wrote to memory of 4160 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 91 PID 3372 wrote to memory of 4160 3372 ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" "C:\Windows\sony\baiduc.dll" /s2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:3804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsh16E0.tmp\System.dll
- Size 10KB
- SHA256 d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
- MD5 bf01b2d04e8fad306ba2f364cfc4edfa
- SHA1 58f42b45ca9fc1818c4498ecd8bac088d20f2b18
- SHA512 30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
- SSDEEP 192:aO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1angMO:vKAFERdlxhGRYUzqZan
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\sony\baiduc.dll
- Size 156KB
- SHA256 1c2a6089585666c2c9ce8b738618f5f30ff12b4100e6bfdc6334bc53a8937726
- MD5 ca0b2a57ba75f9520bea84ba04d684d9
- SHA1 fd751510f0ead9e26703f534c70c2abdc37ee78b
- SHA512 750025c5cbbf3f71ab44c00deb681760bf6a97f6d83e4f96c81030185fe803ef64de31962d77d1392c85f1a4983bbf3e64eae74df807166adc7a01a0324324f1
- SSDEEP 3072:I4EPpQaK3SXZVEMcdt8YR1MTVa/oGabn:I9GaBVEFVcTV8a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system.ini
- Size 247B
- SHA256 ced52d0a44e7111219ec3232ae80b568d0fd96b615f4f22942a1db3a8cae0e6f
- MD5 70b90d2653042f211c433c37833b3b04
- SHA1 2e69bf7acc784817b4a7fd8cd5500d40c9021f78
- SHA512 a38ae94d301ab52ec0186b5bca4f3b42912155bdac76f268ba04152845a7b2f10b832fefb4fc14937ff22fce621d64462d5e03cd9998830b1f8e9e92ba44c254
- MD5 SHA1 SHA512