Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57ac8efe0c41abc45910cecad5cbefbd_JaffaCakes118.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
- Target 57ac8efe0c41abc45910cecad5cbefbd_JaffaCakes118.dll
- Size 352KB
- Sample240519-axtmfagg8y
- SHA256 a8057162da5c27bd345d80ae13cb3a65ea3fc37f94e8a3cb061d2822dfd6630e
- MD5 57ac8efe0c41abc45910cecad5cbefbd
- SHA1 67a8c174d22d3aef9e85e4b01563db6734bea319
- SHA512 0af417779f28bad7593dee8ca4871c2dfc5c397f71d39e81b7fa251d7cf9bd60abecac6d57c81c6877a83ba621e5960f6666d60bc04414b2fdd9abb9de0be2f0
- SSDEEP 6144:VF52XpUuitTrIb9riE2tdkD8c7blFoC/dnCcaHOpTjTBiYGB:T52XeuiqrikDxlbZ6HqrBGB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module" regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}\.0\ = "XML Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}\.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}\.0\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57ac8efe0c41abc45910cecad5cbefbd_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57ac8efe0c41abc45910cecad5cbefbd_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 624 wrote to memory of 1040 624 regsvr32.exe 82 PID 624 wrote to memory of 1040 624 regsvr32.exe 82 PID 624 wrote to memory of 1040 624 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\57ac8efe0c41abc45910cecad5cbefbd_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\57ac8efe0c41abc45910cecad5cbefbd_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1040
-