Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 12:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02095e4b1c71d5da48a7d65ec8df7772_JaffaCakes118.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
02095e4b1c71d5da48a7d65ec8df7772_JaffaCakes118.dll
-
Size
356KB
-
MD5
02095e4b1c71d5da48a7d65ec8df7772
-
SHA1
7f431e759cdf118f40d36c91623d17477b3845c2
-
SHA256
87804e5d6f8ba18fb9caee00ed645908e8c09677e0a0f7c2828d264dcd326148
-
SHA512
9b350330a785954ff1aac6f8f0818ae228c911b01ac6075b6c780786169fc36a38de168ad87e5842b133d6cc1b1375b291357e0967d572896dc9ac6ae4965edd
-
SSDEEP
6144:vPy0+bvrsPMFLx78DR8feW6lWVZd1eRhudevjr/Yl2yIuuiDy4GVd+:vK0+jyDR8pXUYdevjbfyISDdGV
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8}\NoExplorer = "\"\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8} regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{d138faec-e0a3-aedc-82b7-a03ca9c262d4} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars regsvr32.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02095e4b1c71d5da48a7d65ec8df7772_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\ = "Search panel" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02095e4b1c71d5da48a7d65ec8df7772_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\Implemented Categories\{00021493-0000-0000-C000-000000000046} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8}\ = "mysidesearch search enhancer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d138faec-e0a3-aedc-82b7-a03ca9c262d4}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{618dcdb0-9cb4-0839-6b9d-5c0fba9180a8} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1604 wrote to memory of 4536 1604 regsvr32.exe 91 PID 1604 wrote to memory of 4536 1604 regsvr32.exe 91 PID 1604 wrote to memory of 4536 1604 regsvr32.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\02095e4b1c71d5da48a7d65ec8df7772_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\02095e4b1c71d5da48a7d65ec8df7772_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:1696