Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 13:33
Static task
static1
Behavioral task
behavioral1
Sample
f12c66f86051aa4cd5ca0fa117a0797b_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
f12c66f86051aa4cd5ca0fa117a0797b_JaffaCakes118.dll
-
Size
523KB
-
MD5
f12c66f86051aa4cd5ca0fa117a0797b
-
SHA1
1ff9b2de58ad4dcad74485592268c3bfa1e920f5
-
SHA256
170982622474c61c092a10c4bf5b44a26779698a4e4dd44a75f54cad15c3d87d
-
SHA512
0190bfd53d1a693f0927179c460a7d968ed90e627f6b30080bc1e020f2d654cf9838549f1090a0c4486dc56d7e23a8eaa384fd2a38f7ecd08c7fe3a94bcb2343
-
SSDEEP
384:gphNKATHihgelnsKYSpnM1eMyfJ3vf7o4vNTPPqCDz4ZJ8YYYDF:gphtHjKPxM4FDPq44Zwy
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71954FAC-1023-154F-895A-1458258AD817} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{71954FAC-1023-154F-895A-1458258AD817}\ = "ypdjebmp.dll" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\verclsid.exe rundll32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71954FAC-1023-154F-895A-1458258AD817} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71954FAC-1023-154F-895A-1458258AD817}\InprocServer32\ = "C:\\Windows\\SysWow64\\ypdjebmp.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71954FAC-1023-154F-895A-1458258AD817}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{71954FAC-1023-154F-895A-1458258AD817}\InprocServer32 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2604 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2252 wrote to memory of 2604 2252 rundll32.exe 28 PID 2604 wrote to memory of 2516 2604 rundll32.exe 29 PID 2604 wrote to memory of 2516 2604 rundll32.exe 29 PID 2604 wrote to memory of 2516 2604 rundll32.exe 29 PID 2604 wrote to memory of 2516 2604 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f12c66f86051aa4cd5ca0fa117a0797b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f12c66f86051aa4cd5ca0fa117a0797b_JaffaCakes118.dll,#12⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259401769.bat3⤵PID:2516
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121B
MD509517fc62284f33e877a276463580bd1
SHA10b14fe1db4493818f9de0bf2a56ee5370b8d479a
SHA2566cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238
SHA5121b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d