Overview
overview
7Static
static
34e6875dca7...18.exe
windows7-x64
74e6875dca7...18.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...08.dll
windows7-x64
3$PLUGINSDI...08.dll
windows10-2004-x64
3$PLUGINSDI...g2.dll
windows7-x64
3$PLUGINSDI...g2.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3DTCommonRes.dll
windows7-x64
3DTCommonRes.dll
windows10-2004-x64
3DTGadget32.dll
windows7-x64
1DTGadget32.dll
windows10-2004-x64
1DTGadget64.dll
windows7-x64
7DTGadget64.dll
windows10-2004-x64
7DTHelper.exe
windows7-x64
1DTHelper.exe
windows10-2004-x64
1gadget.html
windows7-x64
1gadget.html
windows10-2004-x64
1jquery/jquery.min.js
windows7-x64
3jquery/jquery.min.js
windows10-2004-x64
3jquery/new...ons.js
windows7-x64
3jquery/new...ons.js
windows10-2004-x64
3jquery/newgadget.js
windows7-x64
3jquery/newgadget.js
windows10-2004-x64
3message.html
windows7-x64
1message.html
windows10-2004-x64
1Analysis
- max time kernel
120s - max time network
122s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
17/05/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/FILEDownPlug120308.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/FILEDownPlug120308.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/FILEDownPlug2.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/FILEDownPlug2.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
DTCommonRes.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
DTCommonRes.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
DTGadget32.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral18
Sample
DTGadget32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
DTGadget64.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
DTGadget64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
DTHelper.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
DTHelper.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
gadget.html
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
gadget.html
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
jquery/jquery.min.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
jquery/jquery.min.js
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
jquery/newfunctions.js
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
jquery/newfunctions.js
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
jquery/newgadget.js
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
jquery/newgadget.js
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
message.html
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
message.html
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target DTGadget64.dll
- Size 497KB
- Sample240517-ezzcxshc96
- SHA256 365daf7571d0976fd42f6cea44c08f85ab94705851e770ee7e64d4d95f5b383c
- MD5 72f7eae5ff8544f5ed2f8e20f10d8089
- SHA1 b3e84f951b1330ba8691e936e436f4e61ce28b41
- SHA512 be70f7d1b1e741bd4fec6a4cd670c88365b312d39f8d60868d1414a90e1b99aa7ae243924403774a326e61a9df309dbf06ed9ad9fde60a6f304a5253e3d6cbda
- SSDEEP 6144:oFnOxKVA8CQfpHPqnRhRpe/ua0ovvkWKZWlumr+TFApTR+5eqqDL60xlzlfb3gxo:FKVaG5CnJAcovsdzAu57qn6e6x4l
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Registers COM server for autorun 1 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTGadget64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTGadget64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32 regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\ProgID\ = "DTLiteGadget.RSS.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl.1\ = "GadgetControl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\ = "RSS Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTGadget64.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\VersionIndependentProgID\ = "DTLiteGadget.RSS" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ = "GadgetControl Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ = "IRSS" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS.1\CLSID\ = "{46F8ADC5-0EA1-49d7-9657-56A50133CD42}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\CurVer\ = "DTLiteGadget.GadgetControl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS.1\ = "RSS Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ = "IGadgetControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl.1 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DTGadget.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTGadget64.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\AppID = "{F574FC8D-EFB4-4DAB-AA18-B6C688A8CC58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\AppID = "{F574FC8D-EFB4-4DAB-AA18-B6C688A8CC58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\CLSID\ = "{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ = "IRSS" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\ = "DTGadget 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DTGadget.DLL\AppID = "{F574FC8D-EFB4-4DAB-AA18-B6C688A8CC58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}" regsvr32.exe