Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 18:16
Behavioral task
behavioral1
Sample
f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll
-
Size
86KB
-
MD5
f1ae78d29a2bbaf0b72f8b10c071657a
-
SHA1
ac89ea03c8495d90c06d0d5611b30e92e79befa3
-
SHA256
1b419d7874e37ba8fa505980d0463dffcc97a068da11d70cfac9366ec69f9784
-
SHA512
7f5a7b29be935e3d4eb65a784e997f5b34fbd043cde40776af3b8bb3b27bff881850c5457051f4af62010046bfabbd76728bc652083099f510486b2dd92aeb29
-
SSDEEP
1536:tYvynn+A2Vp83OUrFESgpbQh6xjRa6eLdvZ1K1j5EnAY2KaFKgpfAJVRhkt9S:Wv4+AO834Q+NNG1iOQKiyhk
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2932-0-0x00000000020B0000-0x00000000020EC000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E08AF6D3-634D-4E7C-AADD-04E2A11D6058} regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E08AF6D3-634D-4E7C-AADD-04E2A11D6058} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E08AF6D3-634D-4E7C-AADD-04E2A11D6058}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E08AF6D3-634D-4E7C-AADD-04E2A11D6058}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E08AF6D3-634D-4E7C-AADD-04E2A11D6058}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2932 2760 regsvr32.exe 83 PID 2760 wrote to memory of 2932 2760 regsvr32.exe 83 PID 2760 wrote to memory of 2932 2760 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f1ae78d29a2bbaf0b72f8b10c071657a_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2932
-