Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 08:07
Behavioral task
behavioral1
Sample
043d28141d5cab4a7c50fc5d40e64c9b_JaffaCakes118.dll
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
043d28141d5cab4a7c50fc5d40e64c9b_JaffaCakes118.dll
-
Size
8KB
-
MD5
043d28141d5cab4a7c50fc5d40e64c9b
-
SHA1
468809ce6d5bb279dbb35318a4a5ee2a98e7dcf1
-
SHA256
19ea1917b95e7cefd5229f633468d810501bd6279335960389fce38e4d02880d
-
SHA512
4538c027cf6334df7da6088c5177767e424f4a87a27a9f5f3b590bcf520fd1770815de2a464398a2d5a7c53aca955fc83c76a8cb0519f8cac05f67d469b16d76
-
SSDEEP
96:ns7KTQbinMUMe+gd5O6gVhVQRvVu8imKbanNYNSGcDAKsEzdbfqniSKk:ns+/PZq0RvVu8imdNYYAZEMia
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\ regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\www = "www" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\043d28141d5cab4a7c50fc5d40e64c9b_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3404 wrote to memory of 4408 3404 regsvr32.exe regsvr32.exe PID 3404 wrote to memory of 4408 3404 regsvr32.exe regsvr32.exe PID 3404 wrote to memory of 4408 3404 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\043d28141d5cab4a7c50fc5d40e64c9b_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\043d28141d5cab4a7c50fc5d40e64c9b_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4408