Analysis
- max time kernel
121s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
14/04/2024, 21:58
General
- Target ef9ab2023977e956d28040b05d00703c_JaffaCakes118.dll
- Size 357KB
- Sample240414-1vrceaeg37
- SHA256 0c91706d6fecc4bad18e1e0b527e8bf1ffa13befe9ce2ca6a7ba8513df4e65f8
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Modifies registry class 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef9ab2023977e956d28040b05d00703c_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ef9ab2023977e956d28040b05d00703c_JaffaCakes118.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1016-0-0x0000000010000000-0x0000000010072000-memory.dmp
memory/1016-1-0x00000000015D0000-0x000000000162A000-memory.dmp
memory/1016-2-0x0000000003DE0000-0x0000000003DE2000-memory.dmp
memory/1016-3-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/1016-4-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/1016-5-0x0000000002F50000-0x0000000002F51000-memory.dmp
memory/1016-6-0x0000000003160000-0x0000000003161000-memory.dmp
memory/1016-7-0x0000000003E30000-0x0000000003E31000-memory.dmp
memory/1016-8-0x0000000003210000-0x0000000003211000-memory.dmp
memory/1016-9-0x0000000003E50000-0x0000000003E51000-memory.dmp
memory/1016-10-0x0000000003EC0000-0x0000000003EC1000-memory.dmp
memory/1016-11-0x0000000003EB0000-0x0000000003EB1000-memory.dmp
memory/1016-12-0x0000000003ED0000-0x0000000003ED1000-memory.dmp
memory/1016-13-0x0000000003ED0000-0x0000000003ED1000-memory.dmp