Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 08:37
Static task
static1
Behavioral task
behavioral1
Sample
073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll
-
Size
220KB
-
MD5
073fa3c9d4e14a7480c4190759d799e3
-
SHA1
d842b8f4df7f1d9e251c157d62f2b78913c97d1c
-
SHA256
425daabae56f39d35a83aa918d36c4f8e9ff107f828246e7775cc5ca5bdcb531
-
SHA512
6ca4f940c2ec30d0a46e6302eff2577b89944ded2ff0176169dc55dfbbec9f22ed286bb9e67fb655b18ff4cd17ef314ee622befafa737c6ce16e4cbd929ebe14
-
SSDEEP
3072:4xWEAYnOYWvZVBNG8KxuZ7jghwiz0d/YHYKr0d8YLiVQNovG613ua39Yip9v4fq4:4xWXmOYWvXUighwJabARE4oObsis
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lypnzatx\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll" regsvr32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lypnzatx\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FA19F148-6504-47A7-90E2-32C09D72237D} regsvr32.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\ProgID regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\ regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\Version = "1" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Vitgneor\CLSID regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\ rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\Version = "6" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\ regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\InprocServer32\ = "c:\\users\\admin\\appdata\\local\\temp\\073fa3c9d4e14a7480c4190759d799e3_jaffacakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Vitgneor\CLSID\ = "{FA19F148-6504-47A7-90E2-32C09D72237D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FA19F148-6504-47A7-90E2-32C09D72237D}\ProgID\ = "Vitgneor" regsvr32.exe Key created \Registry\Machine\SOFTWARE\Classes\Vitgneor regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Vitgneor\ regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4356 regsvr32.exe 4356 regsvr32.exe 4356 regsvr32.exe 4356 regsvr32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe 432 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4356 regsvr32.exe Token: SeDebugPrivilege 432 rundll32.exe Token: SeBackupPrivilege 3544 vssvc.exe Token: SeRestorePrivilege 3544 vssvc.exe Token: SeAuditPrivilege 3544 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 432 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4340 wrote to memory of 4356 4340 regsvr32.exe 83 PID 4340 wrote to memory of 4356 4340 regsvr32.exe 83 PID 4340 wrote to memory of 4356 4340 regsvr32.exe 83 PID 4356 wrote to memory of 432 4356 regsvr32.exe 84 PID 4356 wrote to memory of 432 4356 regsvr32.exe 84 PID 4356 wrote to memory of 432 4356 regsvr32.exe 84 PID 4356 wrote to memory of 3548 4356 regsvr32.exe 85 PID 4356 wrote to memory of 3548 4356 regsvr32.exe 85 PID 4356 wrote to memory of 3548 4356 regsvr32.exe 85 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll2⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll",DllMain -3⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Windows\SysWOW64\at.exeC:\Windows\system32\at.exe 10:4:00 /every:Sunday,Monday,Tuesday,Wednesday,Thursday,Friday,Saturday "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\073fa3c9d4e14a7480c4190759d799e3_JaffaCakes118.dll",DllMain -3⤵PID:3548
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3544