Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 17:10
Static task
static1
Behavioral task
behavioral1
Sample
f19008d768186f383e4689279af615e6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f19008d768186f383e4689279af615e6_JaffaCakes118.exe
-
Size
55KB
-
MD5
f19008d768186f383e4689279af615e6
-
SHA1
3e4d8ab42ba1c7da22e24ae082d609b9de384495
-
SHA256
401b2c3651b6f7aded8c3a691c7852aeae6a18798dafc0d727e93aff776ac52f
-
SHA512
b7c2614b8a8ab6e4258da1caef266b4af34833914611446693af75c369e07141d216276b3f844104864b1fffa65a1f1efeb9950e4fd1f7da413358759a1ab625
-
SSDEEP
1536:4N0p091w2dDmVLK9MXIHySUxcZ1FLCqdu:4Q092YDwLK9MYHySUxcDVu
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023277-2.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation f19008d768186f383e4689279af615e6_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2144 regsvr32.exe -
resource yara_rule behavioral2/files/0x0007000000023277-2.dat upx behavioral2/memory/2144-4-0x0000000020000000-0x0000000020023000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects f19008d768186f383e4689279af615e6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{890C7964-9320-4055-BE11-7D7B562A6417} f19008d768186f383e4689279af615e6_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\helper.xml f19008d768186f383e4689279af615e6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstrans.dll f19008d768186f383e4689279af615e6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\TypeLib\ = "{C96aC303-ADB0-4f4b-BBAA-D037694D3590}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\VersionIndependentProgID\ = "Helper.Helper.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\ = "Helper Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\InprocServer32\ = "C:\\Windows\\SysWow64\\mstrans.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{890C7964-9320-4055-BE11-7D7B562A6417}\ProgID\ = "Helper.Helper.1" regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3272 wrote to memory of 2144 3272 f19008d768186f383e4689279af615e6_JaffaCakes118.exe 85 PID 3272 wrote to memory of 2144 3272 f19008d768186f383e4689279af615e6_JaffaCakes118.exe 85 PID 3272 wrote to memory of 2144 3272 f19008d768186f383e4689279af615e6_JaffaCakes118.exe 85 PID 3272 wrote to memory of 1936 3272 f19008d768186f383e4689279af615e6_JaffaCakes118.exe 86 PID 3272 wrote to memory of 1936 3272 f19008d768186f383e4689279af615e6_JaffaCakes118.exe 86 PID 3272 wrote to memory of 1936 3272 f19008d768186f383e4689279af615e6_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f19008d768186f383e4689279af615e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f19008d768186f383e4689279af615e6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s mstrans.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:2144
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F19008~1.EXE >> NUL2⤵PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5fb27d1cac152992654ae662e34f5b350
SHA14af2613c8772adf849bc099cf7e931f378a48d37
SHA256a541d24d0c3713d22a21b2310ebf170929f10371a4528fd5ab1181f7f622aab2
SHA512ace64a4efe00ef589ccfbb8c83a2d3fbb3c9e55665c98195f523e8ec54e59d0f1a4576603c4fe6b8d2d0491b8b5ce45f3c69d254f6912ea2c56fd85a8d789c1f