Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
General
- Target 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe
- Size 9.8MB
- Sample240622-entnas1dnp
- SHA256 15608aa75a68cc98edfd53d5a892f0d8ba12d5ab9cf44e528e7c07f9777ec9c1
- MD5 012ef4d37abb574f336b2c66c3d505ed
- SHA1 96142338f00991b4a65f712b28cc80ad5191e391
- SHA512 7b83b2111cff4d4a13953b15ac0117a56686f2785fa1aa68c9ef59eb0c05aac6b72a73d386da71bc91b8a44fed16a5f2957776633d2dee0788f97b68ed6279f9
- SSDEEP 196608:pdJ4ei+fKy6bobVjrk9+LWdSOSrZYLa7t8PYU2jDVlSC8+H0Okkv:poWfv60VjywiSOBLg8ujDOPvK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe - Executes dropped EXE 1 IoCs
pid Process 1464 xa240595187.exe - Loads dropped DLL 4 IoCs
pid Process 1464 xa240595187.exe 1464 xa240595187.exe 1464 xa240595187.exe 1888 regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62063880-B7E3-3376-990A-D02D91746639} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{62063880-B7E3-3376-990A-D02D91746639}\IExplore = "1" regsvr32.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\wr43929.dll 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe File created C:\Windows\SysWOW64\xwr43929.dll 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe File created C:\Windows\SysWOW64\xa240595187.exe 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe File created C:\Windows\SysWOW64\xa240595390.exe 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xa240595390.exe 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x00070000000233d6-4.dat nsis_installer_1 - Modifies registry class 29 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62063880-B7E3-3376-990A-D02D91746639}\InprocServer32\ = "C:\\Windows\\SysWow64\\xwr43929.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\ = "LIB" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\TypeLib\ = "{FD387FD4-E13F-39C4-9235-47E5E0754F1B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62063880-B7E3-3376-990A-D02D91746639}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62063880-B7E3-3376-990A-D02D91746639}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\TypeLib\ = "{FD387FD4-E13F-39C4-9235-47E5E0754F1B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62063880-B7E3-3376-990A-D02D91746639}\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E50AC25-2B73-31F0-B309-C4E6A1439143}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62063880-B7E3-3376-990A-D02D91746639} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FD387FD4-E13F-39C4-9235-47E5E0754F1B}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\xwr43929.dll" regsvr32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1664 wrote to memory of 1464 1664 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe 85 PID 1664 wrote to memory of 1464 1664 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe 85 PID 1664 wrote to memory of 1464 1664 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe 85 PID 1664 wrote to memory of 1888 1664 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe 94 PID 1664 wrote to memory of 1888 1664 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe 94 PID 1664 wrote to memory of 1888 1664 012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\012ef4d37abb574f336b2c66c3d505ed_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\xa240595187.exe"C:\Windows\system32\xa240595187.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\xwr43929.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsi3470.tmp\InstallOptions.dll
- Size 14KB
- SHA256 610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2
- MD5 32aa6334fc543e70ef0f792bb9a0c45a
- SHA1 54be1f5004f7e5afe7c9ba160495076ea2a4d60c
- SHA512 ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae
- SSDEEP 192:V6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTwK72dwF7dBdcQOz:V6JaVh4I5rpPbTw+BdhO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsi3470.tmp\ioSpecial.ini
- Size 534B
- SHA256 4be5c0b97f7c61fade25a3ce6ed0d140388c3cf49fc2a6c4131bef658e64802e
- MD5 c47f923a3e3c9b644fb8839271c355fa
- SHA1 5db85407541912f24173cc84ec01c3531da92fcb
- SHA512 673914bb9e32efda70b742a4aff542a13d06afdd73a9866ed4356dfbab8e39b7c5b77ef634d6c41b0f244791af41bfc4935650d42a2edd13fca08fa05022a553
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi3470.tmp\setuphlp.dll
- Size 36KB
- SHA256 1924b0511513156110ccad7e06faa127bf4e4f539686685580c57aa430064184
- MD5 43ab89d7dc562b830bd15910f407eff0
- SHA1 2804846b70eecdf025906d59c5057e3eeb26b41f
- SHA512 5a5f6e33f55a9fa1eab7b3071d18868255f4a36b64f070cc1ac4f96cfdbd4bef65b1574577afdf7714614da6fa440ec7434905dacfc7cbf5680e5ed65cdc8e15
- SSDEEP 768:l0WrDg4LEdJxCjwayfYMxjsuSRK7TMdAw7SNZhlDHfxBg/oKoPl:l0mDFuJkwa57M7I2wGNXlDHfGwl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xa240595187.exe
- Size 9.7MB
- SHA256 67dfca880f86278ce821a1f50cb4d10aea05d15f0e33e40e5b5e1b11bdfa6c29
- MD5 2c12b7fd19315d35f32a7fa0bd9625ac
- SHA1 3e0f7f24a7c3b327592ec18844ae4b9fc6b18798
- SHA512 251ea231580f0d4d0d0acb62d2c6ce393aa06a7cbd39152754c8f7dac3cf448cb871b1381da5e07a7a64bdaa689e6ca7c22fa82ed3437ff2de8c82d9f4969d92
- SSDEEP 196608:OdJ4ei+fKy6bobVjrk9+LWdSOSrZYLa7t8PYU2jDVlSC8+H0Okkvc:OoWfv60VjywiSOBLg8ujDOPvKc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xwr43929.dll
- Size 164KB
- SHA256 94b0388a38e389d7798c7d8ccf87125806318a52b58c9aeb277e6e7288ff5386
- MD5 5ec497129d07614bcb88c48b6c563fbd
- SHA1 e5b07c5223e3377f4f0010d6a7be65cdf7d57e14
- SHA512 13b6cf77116fee5d38e8446613d45bc9dde2334b4a7e2c142683426cffc1b9566dbf15d4d9e0191c26faadd014ae13cd248c7e9bdbea64f4b6d98d1f468daf2d
- SSDEEP 3072:6PUYj1oG9gTNp5YSTwQrIWcIqXu8wq9ckz:7Yj1oAqpHUgr8wqN
- MD5 SHA1 SHA512 SSDEEP