Analysis
-
max time kernel
92s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
f19360fb94f2e1e3841cdfc6dbc5fa2f
-
SHA1
eb55681f6d64687bacbc090ab257ceb85fb878f4
-
SHA256
e73827d3293d3634e99721d2aebff884b6bd0b0dc05ee3207979fc2f905157ab
-
SHA512
fb58afb2c0525da94cfce9c6c18e9ce963dcae53c6d6ebce0153bbd6db9ae07554848af7a602c6d0b0d7e9c3ada4771f9fb797b7470bd109b1930976196b21b2
-
SSDEEP
24576:o/AA6D1Z0BPVRI0NMA/vpjS4Iqw3+pySSzTshe6yI7vk59Nb0sNroJ:Ow5FadIqE+pySSzTshef8ecspo
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\Windows\\system32\\ctfmon_oq.exe" regsvr32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 696 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\IExplore = "1" regsvr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xwr36280.dll f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ctfmon_oq.exe regsvr32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3472 set thread context of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\ProgID\ = "D.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\VersionIndependentProgID\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\ = "IDOMPeek" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\TypeLib\ = "{E55E5353-AFB2-3DC3-AD89-057C785EFA93}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\xwr36280.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E}\InprocServer32\ = "C:\\Windows\\SysWow64\\xwr36280.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\ = "IDOMPeek" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74780CC4-AE34-3DE1-91B4-B5FD459DCB1E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\ = "LIB" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\TypeLib\ = "{E55E5353-AFB2-3DC3-AD89-057C785EFA93}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF2F98FA-FEC9-3983-8404-941DC7E74100}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E55E5353-AFB2-3DC3-AD89-057C785EFA93}\1.0\0\win32 regsvr32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3472 wrote to memory of 696 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 86 PID 3472 wrote to memory of 696 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 86 PID 3472 wrote to memory of 696 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 86 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87 PID 3472 wrote to memory of 4760 3472 f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\xwr36280.dll2⤵
- Sets file execution options in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f19360fb94f2e1e3841cdfc6dbc5fa2f_JaffaCakes118.exe2⤵PID:4760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD554fc7ad34a3992ad54f2de2888e61b91
SHA1ffca58cc2ceb6e66165243e249dbc7901a422a81
SHA2564fcc806368134bf266a6c76c9f6106db411699e80bcee350c91c82f24b2d4df8
SHA512057cbeb613c61639222930284443e070cc7e53fa07891b73b84c89f5e378265250e2a08f3e525fc37169d227a34c101cc55d24d74e50eb49494eee9a133c1759