Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
0fd0023347fcef8ac888d4a0e3c61fe1
-
SHA1
0df57d0312499b5ec7c8c4c58d97dd424b7ef417
-
SHA256
493e8ffa6dd24941faedd2a72e119f09f85835c7743191fa036b609886071d21
-
SHA512
22724c420f76bfdfef65a42019792cc0cb5fced5ab00d7c0b46a3f12b20891d6120dbe88499623734370e2efe564e87787f356a8668fadf55f5dbbe42bdf0d5a
-
SSDEEP
24576:HWjwgi3xjA2eCJHU3qZTMQ3N1BhRn7hc3xkwh7iDg8QWcd:HWxiy2eRqKuU38U
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2972 regsvr32mgr.exe -
Loads dropped DLL 4 IoCs
pid Process 2184 regsvr32.exe 2184 regsvr32.exe 2972 regsvr32mgr.exe 2972 regsvr32mgr.exe -
resource yara_rule behavioral1/memory/2972-11-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\NumMethods\ = "4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29840822-5B84-11D0-BD3B-00A0C911CE86}\ = "ICreateDevEnum" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B79BB0B1-33C1-11D1-ABE1-00A0C905F375}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4444AC9E-242E-471B-A3C7-45DCD46352BC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A868AB-0AD4-11CE-B03A-0020AF0BA770} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}\CLSID = "{D3588AB0-0781-11CE-B03A-0020AF0BA770}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92980B30-C1DE-11D2-ABF5-00A0C905F375} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00855B90-CE1B-11D0-BD4F-00A0C911CE86}\ = "IFileSinkFilter2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56ED71A0-AF5F-11D0-B3F0-00AA003761C5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C6545BF0-E76B-11D0-BD52-00A0C911CE86}\NumMethods\ = "8" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62EA93BA-EC62-11D2-B770-00C04FB6BD3D}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B496CE2-811B-11CF-8C77-00AA006B6814}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D51BD5A1-7548-11CF-A520-0080C77EF58A} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\FilterData = 02000000000040000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000700000003170693308000000000000000100000000000000000000003074793300000000700000007000000066696c6500001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B79BB0B1-33C1-11D1-ABE1-00A0C905F375}\NumMethods regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}\FilterData = 02000000020060000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000700000003170693308000000000000000100000000000000000000003074793300000000800000007000000080ea0a67823ad011b79b00aa003767a7000000000000000000000000000000007669647300001000800000aa00389b71 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\ = "IDVSplitter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E1C39A1-DE53-11CF-AA63-0080C744528D}\ = "IAMOpenProgress" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDA42200-BD88-11D0-BD4E-00A0C911CE86} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5738E040-B67F-11D0-BD4D-00A0C911CE86}\ = "IPersistMediaPropertyBag" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A868AC-0AD4-11CE-B03A-0020AF0BA770}\ = "IResourceManager" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33FACFE0-A9BE-11D0-A520-00A0D10129C0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5A4A97E4-94EE-4A55-9751-74B5643AA27D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29840822-5B84-11D0-BD3B-00A0C911CE86}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31EFAC30-515C-11D0-A9AA-00AA0061BE93}\ = "IKsPropertySet" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{02997C3B-8E1B-460E-9270-545E0DE9563E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BF87B6E0-8C27-11D0-B3F0-00AA003761C5}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A2286E0-7BEF-11CE-9BD9-0000E202599C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A868A4-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9FD52741-176D-4B36-8F51-CA8F933223BE}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C6E13380-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F938C991-3029-11CF-8C44-00AA006B6814}\ = "IAMPhysicalPinInfo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1960960-17F5-11D1-ABE1-00A0C905F375}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A70EFE60-E2A3-11D0-A9BE-00AA0061BE93}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{211A8766-03AC-11D1-8D13-00AA00BD8339}\NumMethods\ = "29" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A86893-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C6545BF1-E76B-11D0-BD52-00A0C911CE86}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D51BD5A2-7548-11CF-A520-0080C77EF58A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}\CLSID = "{336475D0-942A-11CE-A870-00AA002FEAB5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A70EFE60-E2A3-11D0-A9BE-00AA0061BE93} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{36B73883-C2C8-11CF-8B46-00805F6CEF60} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22320CB2-D41A-11D2-BF7C-D7CB9DF0BF93}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B5730A90-1A2C-11CF-8C23-00AA006B6814}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00855B90-CE1B-11D0-BD4F-00A0C911CE86}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A86892-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\MJPEG Compressor\FilterData = 02000000000020000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{29840822-5B84-11D0-BD3B-00A0C911CE86}\NumMethods\ = "4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C6E13344-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1960960-17F5-11D1-ABE1-00A0C905F375}\ = "IAMStreamSelect" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A868A9-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B496CE1-811B-11CF-8C77-00AA006B6814}\NumMethods\ = "8" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D51BD5A3-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{211A8760-03AC-11D1-8D13-00AA00BD8339}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56A868AA-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C6E133B0-30AC-11D0-A18C-00A0C9118956}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E436EBB2-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574} regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2092 wrote to memory of 2184 2092 regsvr32.exe 28 PID 2184 wrote to memory of 2972 2184 regsvr32.exe 29 PID 2184 wrote to memory of 2972 2184 regsvr32.exe 29 PID 2184 wrote to memory of 2972 2184 regsvr32.exe 29 PID 2184 wrote to memory of 2972 2184 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
Filesize
154KB
MD5d22c44525dacffd850f75b082f18071e
SHA1229fa56324707512687e75de17e574dc91b08d95
SHA2560e896aab1b9e222cdc0978f0adb780fc5acfa492314eedc1ce9250bc1bdff029
SHA5127ff9a98b45bab4140e31b6be32ba80100124975371f106b78eb1f153b3f15f89516dfb03c6f9faad58e5137b76d8a70ce3d9ba5422aab495dc279d9d77e61c68