Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13f310de2b64411797dcdffe141fece7_JaffaCakes118.dll
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
General
-
Target
13f310de2b64411797dcdffe141fece7_JaffaCakes118.dll
-
Size
160KB
-
MD5
13f310de2b64411797dcdffe141fece7
-
SHA1
c03841524b3d2fad9b9df3c4d2220ba180939ae1
-
SHA256
d141a37514c6de93f1ebbc67d8427e96f083519e20c752c8e940e6149a76d6b6
-
SHA512
a2df2d89eb710f31702ba8ab957edf1c2ace19c3d84af7fafbd7be3f48b6c70fd9afd52aa5b7d9af4dc5c43f999dd47d8d5717632583b0321bcf0d26be6b6f5a
-
SSDEEP
3072:7rDTlF5ofBRLH1ViTPc3+fO4WIvDwJolOmojbKaBu11:7rQRJsTPc3+feEO/Dk1
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system.ini regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13f310de2b64411797dcdffe141fece7_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{296AB1B8-FB22-4D17-8834" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB1B8-FB22-4D17-8834-064E2BA0A6F0}\InProcServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28 PID 2236 wrote to memory of 1344 2236 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\13f310de2b64411797dcdffe141fece7_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\13f310de2b64411797dcdffe141fece7_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
PID:1344
-