Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 12:55
Static task
static1
Behavioral task
behavioral1
Sample
02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll
-
Size
376KB
-
MD5
02384e3d26963deb41905f2ad34e4aa7
-
SHA1
fc5973f87fd3fc370fa2844514f47e8921a7c6fd
-
SHA256
6fabb8bc7d0280fd12133c4ca81ce51876a5843baf9e1d17072ff73501332b57
-
SHA512
3157e4552900a6246f5988632bb926392d22d90aa67d54209cc68252df027d0e77256c98f9b4bfbf53056ce62aac5b989da76fd1351cc4d863eeec48d943ec18
-
SSDEEP
6144:vO3tqChr6sWEFggdltO07/1S0uFMCNLXu4fh9Eo7ZQpa:vTChr6sWEF3FE0uFMCNL+ehGjpa
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zchtijygpruas = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll\"" regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B}\NoExplorer = "1" regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000001800ed6a6e055d6bfaacd6387799771822f481b5cce16779697e680f9657ab3000000000e8000000002000020000000760f3bc2cbc9dbe678ec62f9502bae5007852960d91a47ab45f7af5257431bbc90000000a0381d9c937ffff0478858ac0b26244079f2a5420f5a57597e42f09ce148cdd1f53baa757576d7a857484fcb4a8c72a1bd20e4ec09bb1f670de8f67d6c2fb1377c9eecd2ff354aae5d464390e0e4019b38dbcd3835fe5fc733da3ca67fd09bfc093b6092d824c45a373a32f3577ee27dcb4ae9789d7271f19ff980838e95166b779e3e00ce2c63440a41172cdefd23f9400000007d68561b72360b9ce353889305f2aaaa8b9aceedc38abe1df4dcbb65986d9a7c10dd7f9b54ef037b8ffab840d9d5bca9af0c5852340bfa5faf9cb73f91b5220c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425222830" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000004be374dad438883c15be7e67a4b2b0dc6f41ba95a2711d45fa6c95d9bd4bc81000000000e8000000002000020000000341a71407096a75a5f63623404941eaa259291373610ca35b3e2e5b57e2a13d9200000008c9f0043dc252ea9d23a0063e4319297358ae712b9c4ac5a467b00465545890e400000001f6344341d0239145fa6b1f37be3500690a4dc5d03f9fe28d13b64a26d75c94a1bbe6919220856e6ec7d90878d444ccf907a45fd1c2dc8de61e97f3174b754b7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0062759da3c4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA860661-3096-11EF-89B4-66A5A0AB388F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B}\ = "snappyads browser enhancer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6C6E04-E15D-01BC-67BC-359DC8E03E0B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll" regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 896 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 896 iexplore.exe 896 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 2960 wrote to memory of 3068 2960 regsvr32.exe 28 PID 896 wrote to memory of 2628 896 iexplore.exe 30 PID 896 wrote to memory of 2628 896 iexplore.exe 30 PID 896 wrote to memory of 2628 896 iexplore.exe 30 PID 896 wrote to memory of 2628 896 iexplore.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\02384e3d26963deb41905f2ad34e4aa7_JaffaCakes118.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3068
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:896 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-