Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe
-
Size
152KB
-
MD5
26c3ce51ea5f512973518a41c46ead42
-
SHA1
e8ff6e516cd820311eea653c12f85c1430a3ce5c
-
SHA256
3194d2072144a376ea7b6134f465586ab6ffb4be8a392d4dc274d18f5977cb71
-
SHA512
7a8efe8e8b6a114bf0eaffd940047db90b0bba30e4dbb163d5daec55d8481c48f9ac5694775768e0d049fd9d54a9b1dffe1763cbc538624d5726dbd6f159687f
-
SSDEEP
3072:ltCzs/mVASDVnwevtGjg9DPXcEE+uFXx6kOV/wa19kjygULCO42J:Sw+GSDbvZNUvxVADVYa143UL54u
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b00000001431b-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2792 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x000b00000001431b-1.dat upx behavioral1/memory/2792-3-0x0000000010000000-0x0000000010061000-memory.dmp upx behavioral1/memory/2792-17820-0x0000000010000000-0x0000000010061000-memory.dmp upx behavioral1/memory/2792-19980-0x0000000010000000-0x0000000010061000-memory.dmp upx behavioral1/memory/2792-32494-0x0000000010000000-0x0000000010061000-memory.dmp upx behavioral1/memory/2792-35639-0x0000000010000000-0x0000000010061000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D} 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\msxml71.dll 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe -
Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D} 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Windows\\SysWow64\\msxml71.dll" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C499A7-E4F0-F3CA-21C2-6661A07CDFE3} 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C499A7-E4F0-F3CA-21C2-6661A07CDFE3}\.0\ = "XML Library" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C499A7-E4F0-F3CA-21C2-6661A07CDFE3}\.0 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{D5C499A7-E4F0-F3CA-21C2-6661A07CDFE3}" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C499A7-E4F0-F3CA-21C2-6661A07CDFE3}\.0\ = "C:\\Windows\\SysWow64\\msxml71.dll" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML" 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2792 26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26c3ce51ea5f512973518a41c46ead42_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD52777f5941dc359f2a6fcc46a42b8a2c9
SHA1fe67ffb19044c2365100e1fb78cf3e36348a1ef9
SHA256fec18fac14e2ba839b9b39565d723b01e103a9aa10d4f7d419256802d4676494
SHA51298b28ff12bfc64a8d105d9438b43942dfbe633840d9a15d4b0a56e294048c6c53bb8dc14f8d5852c53224d7542662ec551e3fa1edd0b2937bc328307033eedd3