Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03b6626f558d56cf984e55f22dca4e95_JaffaCakes118.dll
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
03b6626f558d56cf984e55f22dca4e95_JaffaCakes118.dll
-
Size
611KB
-
MD5
03b6626f558d56cf984e55f22dca4e95
-
SHA1
b21a9acb5246ce63a4213ac14b94b9e4c8aaead6
-
SHA256
4393a3e5ef9703abd9ff325bdd713261f3834c48143f550d4c517a18767c6d15
-
SHA512
5b55f5357a69530250b16c5d6ee59049ee6a2df542e98247b143feef106b50ab3e51ea5af661c49a103e30c70f21419d0f911cef6e0d2ef197e7d58af6b426a9
-
SSDEEP
12288:LHunA3tW4LnCRy3eD8MtEl0jflISWXTIrnAxbVAENM8TDC:LOOB3g8HGSDIAZVAENM8TD
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000000}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000000} regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03b6626f558d56cf984e55f22dca4e95_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1928 wrote to memory of 3492 1928 regsvr32.exe regsvr32.exe PID 1928 wrote to memory of 3492 1928 regsvr32.exe regsvr32.exe PID 1928 wrote to memory of 3492 1928 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\03b6626f558d56cf984e55f22dca4e95_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\03b6626f558d56cf984e55f22dca4e95_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3492