b5d5c25c5183d0d4065ce6ece09e692b517a6f24ed4c5cdb9553c47aa675f2db

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25eb80fd3a87c49d8d623ab7bfc694c5_JaffaCakes118.dll
Size

92KB
MD5

25eb80fd3a87c49d8d623ab7bfc694c5
SHA1

e9a9f9e571c2acad59a1d461504ff4f6f1debc87
SHA256

b5d5c25c5183d0d4065ce6ece09e692b517a6f24ed4c5cdb9553c47aa675f2db
SHA512

2b2df4f6fcf66870910eeb7935472a6c25e913d93eea8718ccdfa19aed1938b171c9c7986b0a85f20ef9cfc17841d2102575fcb0cbc3e0debd72b44e688d562a
SSDEEP

1536:b2L+PzX9kRV648MJ38+fg7TZI2LNJ57TGm7sQikBIRZR8F2T+iDztE/sE/r20cCq:y0r90648MJ388jeRsQbIR6fgWzK0cCzG

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\GoogleUpdateCredentialDialog = "{9fb6cc0d-3b42-45df-b7ff-4bf0354dbfe9}"	regsvr32.exe

Loads dropped DLL 2 IoCs

pid	Process
1552	regsvr32.exe
1552	regsvr32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\GoogleUpdate\GoogleUpdateCredentialDialog.dll	regsvr32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9fb6cc0d-3b42-45df-b7ff-4bf0354dbfe9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9fb6cc0d-3b42-45df-b7ff-4bf0354dbfe9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9fb6cc0d-3b42-45df-b7ff-4bf0354dbfe9}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\GoogleUpdate\\GoogleUpdateCredentialDialog.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9fb6cc0d-3b42-45df-b7ff-4bf0354dbfe9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1552	regsvr32.exe
1552	regsvr32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1552	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1552	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1552	1760	regsvr32.exe	78
PID 1760 wrote to memory of 1552	1760	regsvr32.exe	78
PID 1760 wrote to memory of 1552	1760	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\25eb80fd3a87c49d8d623ab7bfc694c5_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\25eb80fd3a87c49d8d623ab7bfc694c5_JaffaCakes118.dll
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\GoogleUpdate\GoogleUpdateCredentialDialog.dll

Filesize
92KB

MD5
25eb80fd3a87c49d8d623ab7bfc694c5

SHA1
e9a9f9e571c2acad59a1d461504ff4f6f1debc87

SHA256
b5d5c25c5183d0d4065ce6ece09e692b517a6f24ed4c5cdb9553c47aa675f2db

SHA512
2b2df4f6fcf66870910eeb7935472a6c25e913d93eea8718ccdfa19aed1938b171c9c7986b0a85f20ef9cfc17841d2102575fcb0cbc3e0debd72b44e688d562a

Download Submit
memory/1552-5-0x0000000000E90000-0x0000000000EA8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads