Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 08:37
Static task
static1
Behavioral task
behavioral1
Sample
073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll
-
Size
220KB
-
MD5
073fa3c9d4e14a7480c4190759d799e3
-
SHA1
d842b8f4df7f1d9e251c157d62f2b78913c97d1c
-
SHA256
425daabae56f39d35a83aa918d36c4f8e9ff107f828246e7775cc5ca5bdcb531
-
SHA512
6ca4f940c2ec30d0a46e6302eff2577b89944ded2ff0176169dc55dfbbec9f22ed286bb9e67fb655b18ff4cd17ef314ee622befafa737c6ce16e4cbd929ebe14
-
SSDEEP
3072:4xWEAYnOYWvZVBNG8KxuZ7jghwiz0d/YHYKr0d8YLiVQNovG613ua39Yip9v4fq4:4xWXmOYWvXUighwJabARE4oObsis
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fbxaltlp\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll" regsvr32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fbxaltlp\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7} regsvr32.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Acogxxld\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\InprocServer32\ = "c:\\users\\admin\\appdata\\local\\temp\\073fa3c9d4e14a7480c4190759d799e3_jaffacakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Acogxxld\CLSID\ = "{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\ regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\InprocServer32 regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\Version = "6" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Acogxxld regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Acogxxld\CLSID regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\Version = "1" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\ rundll32.exe Key created \Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\ProgID\ = "Acogxxld" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{BD0F9A8A-1E84-435C-A277-2D9E3A56A6E7}\ regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2336 regsvr32.exe 2336 regsvr32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2336 regsvr32.exe Token: SeDebugPrivilege 2904 rundll32.exe Token: SeBackupPrivilege 2656 vssvc.exe Token: SeRestorePrivilege 2656 vssvc.exe Token: SeAuditPrivilege 2656 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2904 rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 1304 wrote to memory of 2336 1304 regsvr32.exe 28 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 2904 2336 regsvr32.exe 29 PID 2336 wrote to memory of 1836 2336 regsvr32.exe 30 PID 2336 wrote to memory of 1836 2336 regsvr32.exe 30 PID 2336 wrote to memory of 1836 2336 regsvr32.exe 30 PID 2336 wrote to memory of 1836 2336 regsvr32.exe 30 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll2⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll",DllMain -3⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Windows\SysWOW64\at.exeC:\Windows\system32\at.exe 11:5:00 /every:Sunday,Monday,Tuesday,Wednesday,Thursday,Friday,Saturday "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll",DllMain -3⤵PID:1836
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656