Analysis
-
max time kernel
126s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 18:34
Static task
static1
Behavioral task
behavioral1
Sample
2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll
-
Size
378KB
-
MD5
2359e5ff4ddb2431661a2575069b9228
-
SHA1
4ce3b3f36059e3d8fe2b2eff98096e325456ce7d
-
SHA256
9321f7c0333333189cea832082c33d28e3d8c568762b085939aea86b1d407dca
-
SHA512
7dd7c5384e45351472b52df65d1a46f92da49ee074e6b5447a567c3b5033b3c49f225a9c64610575cadfdd5372fc5b15e0ba2a435d1bd3684fe1108d9cb9b439
-
SSDEEP
3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2MH:vs6Xpq0H3Jhds/9+qC/zfTPLl
Malware Config
Extracted
qakbot
402.343
obama104
1632729661
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Edloqhhbqid = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ichkoeaayyif = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4336 regsvr32.exe -
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\7f0ac488 = 77f4ba702e766197997503f51a1e9dac0a21d4ae29691bc05170f861418e0d9f3e4cd61d4be2d454619e7fbe290ee88137088261cd8e955948faf2975696ba3d3904226f248a4d736a0971c2225b83839ec7a65a5e216957d54ae9233b5f3c8b77e7849e0617bf8bcdf993b2104c56500951b8ceecf91adbb0 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\43ab7e = 2e11af7bf95da743bad39db65b7e3e45a5d68ebb08ae653bebd4b0eed6b31a3a146f709880ffd8a9e0834f50ecad528e79ed8559adf45e32a2d992b117d6bf13baca9224eb127ca2c271c576f3aa18f218b9f57f5f5b4067 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\c7b6a3ed = e55d1f9db33960e849a0b328653e9e6a7ffe9af5606b0156e803570d277f8410281b88742ec83ebba0718ada86375b5ccbee1a8e8ae2812d95b4edafdb615cd6daebaa1fdd1598f647295ec530fb63e103f0c2584b8ef3cab156cb477aad82336841a3818527a0ea6e8d956564d0080d63 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\4a9514c6 = c822f906a46f65151abd93d1b0cb930b0171f22081297a1a88787890aad76a62090c9bc47d8307f80c8613435a846a140a797a8ed389efbf982c76d2e7f3b76ed00b00303caae6f14ca5d4911a1aeca20d728e explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\4a9514c6 = c822ee06a46f504e3518b983c22ed038e0f93b475cdda932ae3d9c1d336287bbb311d342f580ff43b8ce68616defd326ff85ffc3181aa928a247d93cadc5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\7d4be4f4 = 1fe3ceaefba2469b31e10ba21cda0bfdb32505e37e703609b10148441cf467bf2e5b59ddcbaafb4f78d162e5b8a32e69051259abf5a70f4534c487848f25d285776b2002d57832bb0d109843ebe08bf9a10045e5b048640a8b16c328cf08e0c4a051de0fdd14a29d343a23716f92826f8e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\c5f78391 = a061bc02e8de6245fe09cf1a7830cf05714a14cec6507ec7f0b714e110288e4e54c86eb3cf02861a633e46b74ef5055de85cf60284a999dfca3cd3d9b4cbeb1cf32691e225da5d3a22d1d1768d9347affaa2fbaeebc606c1198ef9d6d2c2b774809852f4774320bb explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\b8ffcc1b = 6f90fdefc4b6acf23b9ac84baa0f965bfe5d53416ea9e08724e1e30cf3dbf2b2 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Boitsoiwnofyq\35dc7b30 = 7391a7f52dfdea6821df97e4f4a5f2270d7b5ccf3389a4198daadfe1eb01d3afa34e9f7c1c19cb34d942a7d5e94e1325f83c829f0c9437032ce1bb88f23152b03d3dc7b6725222dc2e15774e74d59537314ded782b157beb133a explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1060 rundll32.exe 1060 rundll32.exe 4336 regsvr32.exe 4336 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1060 rundll32.exe 4336 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3500 wrote to memory of 1060 3500 rundll32.exe rundll32.exe PID 3500 wrote to memory of 1060 3500 rundll32.exe rundll32.exe PID 3500 wrote to memory of 1060 3500 rundll32.exe rundll32.exe PID 1060 wrote to memory of 5052 1060 rundll32.exe explorer.exe PID 1060 wrote to memory of 5052 1060 rundll32.exe explorer.exe PID 1060 wrote to memory of 5052 1060 rundll32.exe explorer.exe PID 1060 wrote to memory of 5052 1060 rundll32.exe explorer.exe PID 1060 wrote to memory of 5052 1060 rundll32.exe explorer.exe PID 5052 wrote to memory of 5064 5052 explorer.exe schtasks.exe PID 5052 wrote to memory of 5064 5052 explorer.exe schtasks.exe PID 5052 wrote to memory of 5064 5052 explorer.exe schtasks.exe PID 3096 wrote to memory of 4336 3096 regsvr32.exe regsvr32.exe PID 3096 wrote to memory of 4336 3096 regsvr32.exe regsvr32.exe PID 3096 wrote to memory of 4336 3096 regsvr32.exe regsvr32.exe PID 4336 wrote to memory of 4720 4336 regsvr32.exe explorer.exe PID 4336 wrote to memory of 4720 4336 regsvr32.exe explorer.exe PID 4336 wrote to memory of 4720 4336 regsvr32.exe explorer.exe PID 4336 wrote to memory of 4720 4336 regsvr32.exe explorer.exe PID 4336 wrote to memory of 4720 4336 regsvr32.exe explorer.exe PID 4720 wrote to memory of 3176 4720 explorer.exe reg.exe PID 4720 wrote to memory of 3176 4720 explorer.exe reg.exe PID 4720 wrote to memory of 3008 4720 explorer.exe reg.exe PID 4720 wrote to memory of 3008 4720 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qmlgdpft /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll\"" /SC ONCE /Z /ST 18:36 /ET 18:484⤵
- Scheduled Task/Job: Scheduled Task
PID:5064
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\2359e5ff4ddb2431661a2575069b9228_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Edloqhhbqid" /d "0"4⤵
- Windows security bypass
PID:3176
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ichkoeaayyif" /d "0"4⤵
- Windows security bypass
PID:3008
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD52359e5ff4ddb2431661a2575069b9228
SHA14ce3b3f36059e3d8fe2b2eff98096e325456ce7d
SHA2569321f7c0333333189cea832082c33d28e3d8c568762b085939aea86b1d407dca
SHA5127dd7c5384e45351472b52df65d1a46f92da49ee074e6b5447a567c3b5033b3c49f225a9c64610575cadfdd5372fc5b15e0ba2a435d1bd3684fe1108d9cb9b439
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e