Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
0fd0023347fcef8ac888d4a0e3c61fe1
-
SHA1
0df57d0312499b5ec7c8c4c58d97dd424b7ef417
-
SHA256
493e8ffa6dd24941faedd2a72e119f09f85835c7743191fa036b609886071d21
-
SHA512
22724c420f76bfdfef65a42019792cc0cb5fced5ab00d7c0b46a3f12b20891d6120dbe88499623734370e2efe564e87787f356a8668fadf55f5dbbe42bdf0d5a
-
SSDEEP
24576:HWjwgi3xjA2eCJHU3qZTMQ3N1BhRn7hc3xkwh7iDg8QWcd:HWxiy2eRqKuU38U
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3084 regsvr32mgr.exe -
Loads dropped DLL 1 IoCs
pid Process 3084 regsvr32mgr.exe -
resource yara_rule behavioral2/memory/3084-7-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3444 3084 WerFault.exe 83 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99D54F63-1A69-41AE-AA4D-C976EB3F0713} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\FilterData = 020000000100004002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b7180eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba77000000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36B73880-C2C8-11CF-8B46-00805F6CEF60}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868AA-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31EFAC30-515C-11D0-A9AA-00AA0061BE93}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A03CD5F0-3045-11CF-8C44-00AA006B6814}\ = "IAMExtTransport" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{211A8761-03AC-11D1-8D13-00AA00BD8339}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A70EFE61-E2A3-11D0-A9BE-00AA0061BE93}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A8689C-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B496CE1-811B-11CF-8C77-00AA006B6814}\NumMethods\ = "8" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92980B30-C1DE-11D2-ABF5-00A0C905F375}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868A2-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1960960-17F5-11D1-ABE1-00A0C905F375}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868A6-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9FD52741-176D-4B36-8F51-CA8F933223BE}\NumMethods\ = "5" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6E13343-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22320CB2-D41A-11D2-BF7C-D7CB9DF0BF93} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1643E180-90F5-11CE-97D5-00AA0055595A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89C31040-846B-11CE-97D3-00AA0055595A}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A70EFE61-E2A3-11D0-A9BE-00AA0061BE93}\ = "IDvdControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B79BB0B0-33C1-11D1-ABE1-00A0C905F375}\ProxyStubClsid32\ = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6E13350-30AC-11D0-A18C-00A0C9118956}\ = "IAMAnalogVideoDecoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868A3-0AD4-11CE-B03A-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{211A8766-03AC-11D1-8D13-00AA00BD8339}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B79BB0B0-33C1-11D1-ABE1-00A0C905F375}\NumMethods\ = "7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868A5-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{E436EB86-524F-11CE-9F53-0020AF0BA770} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5738E040-B67F-11D0-BD4D-00A0C911CE86}\NumMethods\ = "7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8E8BD60-0BFE-11D0-AF91-00AA00B67A42}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1C39A1-DE53-11CF-AA63-0080C744528D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868A9-0AD4-11CE-B03A-0020AF0BA770} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868AD-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E651CC0-B199-11D0-8212-00C04FC32C45} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{301056D0-6DFF-11D2-9EEB-006008039E37}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A8689F-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868AB-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D18E17A0-AACB-11D0-AFB0-00AA00B67A42}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6545BF1-E76B-11D0-BD52-00A0C911CE86}\ = "IAMDevMemoryControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}\CLSID = "{A888DF60-1E90-11CF-AC98-00AA004C0FA9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}\FriendlyName = "MPEG Audio Decoder" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}\FilterData = 0200000000006000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F185FE76-E64E-11D2-B76E-00C04FB6BD3D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A8689D-0AD4-11CE-B03A-0020AF0BA770}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D51BD5A3-7548-11CF-A520-0080C77EF58A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5ACD6AA0-F482-11CE-8B67-00AA00A3F1A6}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89C31040-846B-11CE-97D3-00AA0055595A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F938C991-3029-11CF-8C44-00AA006B6814} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D18E17A0-AACB-11D0-AFB0-00AA00B67A42}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51B4ABF3-748F-4E3B-A276-C828330E926A}\InprocServer32 regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}\FilterData = 020000000000600003000000000000003070693300000000000000000400000000000000000000003074793300000000d8000000e80000003174793300000000d8000000f80000003274793300000000d8000000080100003374793300000000d8000000180100003170693309000000000000000200000000000000000000003074793300000000280100003801000031747933000000002801000048010000327069330900000000000000020000000000000000000000307479330000000058010000380100003174793300000000580100006801000083eb36e44f52ce119f530020af0ba77084eb36e44f52ce119f530020af0ba77085eb36e44f52ce119f530020af0ba77086eb36e44f52ce119f530020af0ba77087eb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b7180eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b717669647300001000800000aa00389b7181eb36e44f52ce119f530020af0ba770 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\Source Filter = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8E8BD60-0BFE-11D0-AF91-00AA00B67A42}\NumMethods\ = "5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A86895-0AD4-11CE-B03A-0020AF0BA770}\ = "IBaseFilter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{944D4C00-DD52-11CE-BF0E-00AA0055595A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33BC7430-EEC0-11D2-8201-00A0C9D74842}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1C39A1-DE53-11CF-AA63-0080C744528D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56A868AA-0AD4-11CE-B03A-0020AF0BA770}\ = "IAsyncReader" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{632105FA-072E-11D3-8AF9-00C04FB6BD3D} regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5116 wrote to memory of 3192 5116 regsvr32.exe 82 PID 5116 wrote to memory of 3192 5116 regsvr32.exe 82 PID 5116 wrote to memory of 3192 5116 regsvr32.exe 82 PID 3192 wrote to memory of 3084 3192 regsvr32.exe 83 PID 3192 wrote to memory of 3084 3192 regsvr32.exe 83 PID 3192 wrote to memory of 3084 3192 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0fd0023347fcef8ac888d4a0e3c61fe1_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 101764⤵
- Program crash
PID:3444
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3084 -ip 30841⤵PID:3064
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
154KB
MD5d22c44525dacffd850f75b082f18071e
SHA1229fa56324707512687e75de17e574dc91b08d95
SHA2560e896aab1b9e222cdc0978f0adb780fc5acfa492314eedc1ce9250bc1bdff029
SHA5127ff9a98b45bab4140e31b6be32ba80100124975371f106b78eb1f153b3f15f89516dfb03c6f9faad58e5137b76d8a70ce3d9ba5422aab495dc279d9d77e61c68