Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 15:30
Behavioral task
behavioral1
Sample
f16300d6d4765295c22d114d06373463_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f16300d6d4765295c22d114d06373463_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f16300d6d4765295c22d114d06373463_JaffaCakes118.exe
-
Size
97KB
-
MD5
f16300d6d4765295c22d114d06373463
-
SHA1
c0549f51aee3c729ebc38badab63acf3c8655b7e
-
SHA256
6eeb5c03c0c5400e0eb0eb08f6d494a6de199ed1ad44e2a3cfac772681f21b2e
-
SHA512
f37aac8fb4e077f4357dc72af9d0685e5f63dea01ccfeec81f9a0993e650ac2f6d8c578072628b470869d015f5d993aa61a5c5abb3be5bcb942bdd00c0c73c1b
-
SSDEEP
1536:Nb0UmA5JiTmHxJtUlAn9IO+sGyfYaInyuddxnpF/iuDUR57Zld5KATgty7V4hxfE:57mjTmRJSQWxyudf2T5KATgKVVQY5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2496 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1752 PostTip.exe -
Loads dropped DLL 7 IoCs
pid Process 2408 regsvr32.exe 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 1752 PostTip.exe 1752 PostTip.exe 1752 PostTip.exe 2708 regsvr32.exe -
resource yara_rule behavioral1/memory/1728-0-0x0000000000400000-0x0000000000448000-memory.dmp upx behavioral1/memory/1728-25-0x0000000000400000-0x0000000000448000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PostTip = "C:\\Program Files (x86)\\PostTip\\PostTip.exe" PostTip.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454B-AC3B-437F30BEA671} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\PostTip\PostTip.exe f16300d6d4765295c22d114d06373463_JaffaCakes118.exe File created C:\Program Files (x86)\PostTip\PostTip.dll f16300d6d4765295c22d114d06373463_JaffaCakes118.exe File created C:\Program Files (x86)\PostTip\uninstall.exe f16300d6d4765295c22d114d06373463_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID\ = "SideTab.SideTabCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PostTip\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer\ = "SideTab.SideTabCtl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer\ = "SideTab.SideTabCtl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ = "PostTip" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ = "ISideTabCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID\ = "SideTab.SideTabCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID\ = "SideTab.SideTabCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\ = "SideTabCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ = "PostTip" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\ = "SideTabCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\ = "SideTab 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID\ = "{C4BF6897-41A2-454b-AC3B-437F30BEA671}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0\win32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ = "ISideTabCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\VersionIndependentProgID\ = "SideTab.SideTabCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl.1\ = "SideTabCtl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A12EF54F-2691-4C32-AC1B-F65D144A3988}\1.0\0\win32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib\ = "{A12EF54F-2691-4C32-AC1B-F65D144A3988}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2B006B6-159A-4384-B05C-4B5511C16354}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SideTab.SideTabCtl\ = "SideTabCtl Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4BF6897-41A2-454b-AC3B-437F30BEA671}\InprocServer32\ = "C:\\Program Files (x86)\\PostTip\\PostTip.dll" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe Token: SeBackupPrivilege 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 1752 PostTip.exe 1752 PostTip.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 2408 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 28 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 1752 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 29 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1728 wrote to memory of 2496 1728 f16300d6d4765295c22d114d06373463_JaffaCakes118.exe 30 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32 PID 1752 wrote to memory of 2708 1752 PostTip.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f16300d6d4765295c22d114d06373463_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f16300d6d4765295c22d114d06373463_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PostTip\PostTip.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2408
-
-
C:\Program Files (x86)\PostTip\PostTip.exe"C:\Program Files (x86)\PostTip\PostTip.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PostTip\PostTip.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2708
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c \DelUS.bat2⤵
- Deletes itself
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271B
MD5252889d3869deba6315d6c3b11ce84d8
SHA1941d9e82932e4bf136c85fc61e29cbb0dad3e6b0
SHA2565747144f85be15d7c09aa09f1f565e7640257e314ea362b680713d1d6017df2c
SHA512bc942556e6a36240fc058167d67fba37a651915f9211ddb0b2f39bef52dd1a6b260c7b9b6fab6e5ce0987ee509f0abe2a62631272b1fd7e3c358873a6cf1056c
-
Filesize
162KB
MD5dc62c2f61a803bd1292b0b169fa6f8d9
SHA1117ecef652f645ab87a611eab5bc16ae085d6ffb
SHA2567434776f552dde651370f0e43026def6c56c412eb1c62d5214406b34144319af
SHA51255f22c83fcfccf10bb799af214b456392f43b7c394a7dcebbe2fe7059c65ba2fad859c9709b4ca2ab28ab55f03e054196a5b3857a0ec09c3b603a3458cb212d1
-
Filesize
38KB
MD5c2b5be376cac31c0b01603105ae4ea89
SHA14fcfa0181ca5478103c6999199957be40f4a937b
SHA2568ec9ca043b655d4bf868ccd7d9d5fdd4e23ad8610aed2fb983370437b7851feb
SHA512d17e798a414a6d2295f13339a10151f2a34cff5a7d6c81862c26a0c4ac831bf9f867f9f2bf028fa15f189a93f8d8883a334a9857a33bcabac916376267c9da72