Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/06/2024, 23:55
Behavioral task
behavioral1
Sample
014a4e0f8b5d53c5fd19828160d71c20_JaffaCakes118.dll
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
014a4e0f8b5d53c5fd19828160d71c20_JaffaCakes118.dll
Resource
win10v2004-20240508-en
6 signatures
150 seconds
General
-
Target
014a4e0f8b5d53c5fd19828160d71c20_JaffaCakes118.dll
-
Size
321KB
-
MD5
014a4e0f8b5d53c5fd19828160d71c20
-
SHA1
b9bc8dd7ef8339deab56a744d2d789923b2d6407
-
SHA256
d6038bac11bd880dcb7c28aeab4148c281cff4f2f0e5c0bd820a332932bab544
-
SHA512
77c230ac73e7bf1c34fae9e0c33d695a146be8c4960d1a43ca75c9e4538fa327499a6ffee1b4091dda021f44fee23c4eb6e8956b091ee2ea6f18606c43cba91d
-
SSDEEP
6144:Vha8l+W0ir/7cF3DXWSH3YIoH7ljQu7ynn/kVRA2GgFiorZTd6u4GJOP/lP5yhYh:L3f/K3KSH3Zob5Qgy/N9p256u4lhyhYh
Score
8/10
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\scbiywnd\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\014a4e0f8b5d53c5fd19828160d71c20_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\scbiywnd\Parameters\ServiceDll = "c:\\users\\admin\\appdata\\local\\temp\\014a4e0f8b5d53c5fd19828160d71c20_jaffacakes118.dll" svchost.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\scbiywnd\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k scbiywnd" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\scbiywnd\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k scbiywnd" svchost.exe -
resource yara_rule behavioral1/memory/1676-0-0x0000000000A90000-0x0000000000B74000-memory.dmp upx behavioral1/memory/2308-1-0x0000000000640000-0x0000000000724000-memory.dmp upx behavioral1/memory/2308-3-0x0000000000640000-0x0000000000724000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4}\WpadDecisionTime = 002acf1da4c2da01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4}\aa-e3-bc-f6-08-2c svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4}\WpadDecisionTime = 20f65343a4c2da01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-e3-bc-f6-08-2c\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-e3-bc-f6-08-2c\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-e3-bc-f6-08-2c\WpadDecisionTime = 002acf1da4c2da01 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-e3-bc-f6-08-2c svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0039000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0039000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4}\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4}\WpadNetworkName = "Network 3" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3336CDC6-A9D1-4922-8D70-2DAF5964B1B4} svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-e3-bc-f6-08-2c\WpadDetectedUrl svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-e3-bc-f6-08-2c\WpadDecisionTime = 20f65343a4c2da01 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 756 wrote to memory of 1676 756 regsvr32.exe 28 PID 756 wrote to memory of 1676 756 regsvr32.exe 28 PID 756 wrote to memory of 1676 756 regsvr32.exe 28 PID 756 wrote to memory of 1676 756 regsvr32.exe 28 PID 756 wrote to memory of 1676 756 regsvr32.exe 28 PID 756 wrote to memory of 1676 756 regsvr32.exe 28 PID 756 wrote to memory of 1676 756 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\014a4e0f8b5d53c5fd19828160d71c20_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\014a4e0f8b5d53c5fd19828160d71c20_JaffaCakes118.dll2⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
PID:1676
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k scbiywnd1⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2308