Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 18:16
Behavioral task
behavioral1
Sample
f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll
-
Size
86KB
-
MD5
f1ae78d29a2bbaf0b72f8b10c071657a
-
SHA1
ac89ea03c8495d90c06d0d5611b30e92e79befa3
-
SHA256
1b419d7874e37ba8fa505980d0463dffcc97a068da11d70cfac9366ec69f9784
-
SHA512
7f5a7b29be935e3d4eb65a784e997f5b34fbd043cde40776af3b8bb3b27bff881850c5457051f4af62010046bfabbd76728bc652083099f510486b2dd92aeb29
-
SSDEEP
1536:tYvynn+A2Vp83OUrFESgpbQh6xjRa6eLdvZ1K1j5EnAY2KaFKgpfAJVRhkt9S:Wv4+AO834Q+NNG1iOQKiyhk
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E0B205E-E3E3-4176-8D64-E1718538AB8D} regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E0B205E-E3E3-4176-8D64-E1718538AB8D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E0B205E-E3E3-4176-8D64-E1718538AB8D}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E0B205E-E3E3-4176-8D64-E1718538AB8D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E0B205E-E3E3-4176-8D64-E1718538AB8D} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2512 2060 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2512
-