Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 06:41
Behavioral task
behavioral1
Sample
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe
-
Size
232KB
-
MD5
03b9785568f7a6fd0b5a1f4ea78452c1
-
SHA1
282c2f00bf6f475826e721b40ca79318d60145af
-
SHA256
25705af0a5b07fd75329f3f060a77849aab5c4a2bb93c4d3d5b4e30cdc7c5493
-
SHA512
41fd7866e09a36884680eaf2ef5e5d07b7849077a831b4686ba08293d007d0be7f86d4bccd83a7d39cf27dfcbf818b4536ce673ec481d62cbd187bdf6b29f3af
-
SSDEEP
6144:YkbtRFd4KupxxrYFOJghXs+q8Fpg7gQ8+:YkbtRFzun6KN8Fpgh
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Windows\SysWOW64\EO0CRKl20.dll aspack_v212_v242 C:\Windows\SysWOW64\EO0CRKl10.dll aspack_v212_v242 -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exe03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exepid process 2964 regsvr32.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EO0CRKl = "C:\\Windows\\system32\\EO0CRKl.exe" 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{94AC7942-7BE1-4FB9-A7CA-67CD88362758} regsvr32.exe -
Drops file in System32 directory 6 IoCs
Processes:
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\EO0CRKl10.dll 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\EO0CRKl.exe 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe File created C:\Windows\SysWOW64\EO0CRKl.exe 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\EO0CRKl20.dll 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe File created C:\Windows\SysWOW64\EO0CRKl20.dll 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\EO0CRKl10.dll 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3248 3524 WerFault.exe 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe -
Modifies registry class 42 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\ = "IEHelper 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ = "IEHlprObj Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\ = "IEHlprObj Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib\ = "{94AC7948-7BE1-4FB9-A7CA-67CD88362758}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\ = "IEHlprObj Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\InprocServer32\ = "C:\\Windows\\SysWow64\\EO0CRKl20.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ = "IIEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ = "IIEHlprObj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib\ = "{94AC7948-7BE1-4FB9-A7CA-67CD88362758}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\ = "IEHlprObj.IEHlprObj.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\VersionIndependentProgID\ = "IEHlprObj.IEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\EO0CRKl20.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94AC7941-7BE1-4FB9-A7CA-67CD88362758}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID\ = "{94AC7942-7BE1-4FB9-A7CA-67CD88362758}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AC7942-7BE1-4FB9-A7CA-67CD88362758}\ProgID\ = "IEHlprObj.IEHlprObj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{94AC7948-7BE1-4FB9-A7CA-67CD88362758}\1.0\FLAGS regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exeregsvr32.exepid process 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 2964 regsvr32.exe 2964 regsvr32.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exedescription pid process target process PID 3524 wrote to memory of 2964 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe regsvr32.exe PID 3524 wrote to memory of 2964 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe regsvr32.exe PID 3524 wrote to memory of 2964 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe regsvr32.exe PID 3524 wrote to memory of 3512 3524 03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03b9785568f7a6fd0b5a1f4ea78452c1_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\EO0CRKl20.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 4763⤵
- Program crash
PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3524 -ip 35241⤵PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD57daa7e8ae1b87690d652bd324d372a9b
SHA164606cbc9f319662f315d7fdf8a5ed8b9ec3f163
SHA25652669174c55fcd0fa6af47044205bee4d3d84bfdb85ad81574e2f45e39db98ff
SHA512e312f2c74dd31da7463fc525716c0f9935e11d60130eb232ea525ff8a35187fefbbf71fdb1c99b91507b5e7f41eb990f0e0196c3663903a2cca43e6774bdfd5c
-
Filesize
87KB
MD559cc50390cad44b281b20bb771c44835
SHA162c941343233c001a6a095a33a60eb47d6f55500
SHA2564ae5bf8ef6335e5a06fa3232de43e50ee06f2c8d51c6a1e341d40cd03fb489b5
SHA51281401ee0fea1bfc543bf16d3cd4b785a70acc5f5c4dc15b737e46409c98d23a4f265a996444bd614529d4886a03916b76223023b874d91d3c4aab36c8e69bbac