Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 06:43
Static task
static1
Behavioral task
behavioral1
Sample
03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll
-
Size
164KB
-
MD5
03bc1d04f70e19bb81c708d76e691980
-
SHA1
b48e31fd8482af0d3d97fee656a8b596f6662501
-
SHA256
b3748662638def24fb913047823d8053c23c33c7085924d39787e5e7068d74c6
-
SHA512
a01a63b73521663c71022a8f3c155c1282d9f84951453721441b579c3489ed20b1f9699beaff72d42d44e46aa27a09f99380bf448a7bcc77640637ceb026240c
-
SSDEEP
3072:e2wKiBvyO6HcUcoW9mvx6QpQA/MThuVwkyDNbpRIVyyzC5Rnl:e2wKIyRcloW9BQpSlkYNbpRKv+n
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lfmssgagra = "C:\\Windows\\System32\\Rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll\" EntryPoint" regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3a763d55-20ab-c7db-48a7-8d8f487a7866} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3a763d55-20ab-c7db-48a7-8d8f487a7866}\NoExplorer = "\"\"" regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3a763d55-20ab-c7db-48a7-8d8f487a7866} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3a763d55-20ab-c7db-48a7-8d8f487a7866}\ = "agadoo browser enhancer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3a763d55-20ab-c7db-48a7-8d8f487a7866}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3a763d55-20ab-c7db-48a7-8d8f487a7866}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3a763d55-20ab-c7db-48a7-8d8f487a7866}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 2188 1584 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\03bc1d04f70e19bb81c708d76e691980_JaffaCakes118.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2188