Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll
-
Size
404KB
-
MD5
0220112765fa22ba3be7cd05353b6bf0
-
SHA1
31a3aa911f92702ce670e71086b904999e0d5612
-
SHA256
0dcc0c3caa0fd9160c8576e09df6ab84da3c7d2309100357b22ebcf5c7c2a4e0
-
SHA512
ca6eee46455ad556ef7b0e6249fdb37999c397815b963a8faad03a70a3c15cc11bedd6994ecf3592787c0c81b6659520e855274dcbed970fca02fc1991f09986
-
SSDEEP
6144:6opJ0HKwFjTI/V19/XNa6JGH5TOtyHxT9/M+uwYpWpqQDELgnXbE+xNa+QpO9pf1:5JbNvrWqvcYM5APy27Nc1IAaWH
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ireyqqljdifx = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll\"" regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F33301BD-4953-2C11-B971-9493876A6CC5}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F33301BD-4953-2C11-B971-9493876A6CC5} regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425221242" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{151E45F1-3093-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F33301BD-4953-2C11-B971-9493876A6CC5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F33301BD-4953-2C11-B971-9493876A6CC5}\ = "incomeland browser enhancer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F33301BD-4953-2C11-B971-9493876A6CC5}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F33301BD-4953-2C11-B971-9493876A6CC5}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F33301BD-4953-2C11-B971-9493876A6CC5}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll" regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2948 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2948 iexplore.exe 2948 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2008 wrote to memory of 2772 2008 regsvr32.exe 28 PID 2948 wrote to memory of 2556 2948 iexplore.exe 30 PID 2948 wrote to memory of 2556 2948 iexplore.exe 30 PID 2948 wrote to memory of 2556 2948 iexplore.exe 30 PID 2948 wrote to memory of 2556 2948 iexplore.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0220112765fa22ba3be7cd05353b6bf0_JaffaCakes118.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2772
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56595e6a96e5afcb2fa7cc2008c73c680
SHA12297638fe66a63125623d44aa614c8734dedc962
SHA256fdaaa710e1af341443d92faf1709f7e84b29b7cdcc7e1c4da62db96afb860e37
SHA512f0821e6fbbcbe80f92120cfcd0ecb8d42f4c69dbb2cb75e57542e7526681b39e52560122dc3b2cc73c32a4da88aaf22f57d6a2079dd8e64a8f75f6382b1ae21c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505adeeb6d18d326fa53d8d67e70641c3
SHA14c901bbfa877846b56693f6968ae5f6e1a9f447f
SHA25632dba2fc4a04458e2145c5ef94463c0ee3071f6490c37052325f4149baa3fc4f
SHA512c45f2c11476d8660b371b1e3fd5059f695033e31740111ccb60f754cd9afc0017635b41b23508fcaae0a5268bf91fc8d98d83a40f9c48a3a409539c41241a969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522b547b1616f29b894c04213a6ef8dcf
SHA16479f5dd0f8230f88c02cc5fe878373991d0fe2b
SHA2565a1aba70e7196e0069403acae6b61ced3ea99708df1d3f8a7f5fd9f09dcde6f4
SHA512d9be8637ef1c3c8d2b113a3735fb029ad50536c956a08e651fb625ab50cf159698871c0ede760800807379e4c1cb8557648999b9e138f18d041dbef53b82eb5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5419acab8c84215e9edb703335b7e910b
SHA1695e3a6423c0117b6d9db51caad2841d8a070ff2
SHA25662ab504dd568c2cea48fc08ad87c70b913d885ad0bc2206e9eb565f966797903
SHA512d2f51acf8143bcffbfda543e2a0eb8089154b2d6dfc544d288e1ecd05a7beb9fac1729969cad8ef248af8d42c74abc113246ed01613b7b0e71387ede738c710e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548343cfd25fc77069df0779fe5c84b5f
SHA16170cbc28af2b2280fc1e9bf0fbf6fcc51d50f55
SHA256ddec0074fea16c3bab86bc51f3bccf5364a78b2e2c462ae777a1ad011a464892
SHA512652fdb3e90cb72c4985df1e40481135e0f8f5cd1ab242693d8a883374f7e1d502154f1c135eca0f5210897572c34e5f9f91f43f6d2f8ffceeb290e8c3be5f383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e11bc1443ae8cf0233d074f9cebdc2f
SHA10274feee57a5d62a2db6a683538c2b994dacf8b2
SHA2565feb4c73e81dfd51ab7b9d4946c3fb6e47f54f51900a07e4f9c2a209c8543185
SHA51293123c532d751fe1d47f4531d3d84618b584d2da70684c6f3e0331c00598d1ec899e2ef5d78ea5aacc7eacab3e0f5f9e27c9c0d20172a0da687fef82f03ad6ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54eeb52e1ecf93afeb1c23afc2ce81437
SHA187958d95f6fa20c2b512052374e610d9d6f9aeda
SHA256f08039d59a6cf1969acac058534add369b820c28d3b1d425d07199f05a2d71fe
SHA512cac308de3fa8e6da748cb15667edddbbb5dd7ae1e82d5f482314208f3f8befe974ba49188e0e65ee5540717d4f935c4a91eeb074024c760f5227596a6572cb17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9990b09a1ba4c0bcb9409ce155832fb
SHA175f947ebb12391045059e05b18b87e2d59db412e
SHA25615aa92155b7672efbd107db6f5611fcf5dd983c8357eb68072e18b4707386be4
SHA5121b45d8b9d88c3e58ffc4d914ac11c8a0be7d17f33ec8b4575b47ec0861cd63c0b673608966a1bf6b451a65e65fa27ae5ccfffde33422d2724d2b5160593d6029
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b