Analysis
- max time kernel
93s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
10/07/2024, 07:34
Behavioral task
behavioral1
Sample
33cf5e629bcc89e9f004aea4fa052096_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
General
- Target 33cf5e629bcc89e9f004aea4fa052096_JaffaCakes118.dll
- Size 755KB
- Sample240710-jedypsvbrj
- SHA256 5aa86f300b6351fa41af262aa8c92804d891c15d78c4cbd9812b22813a9d0004
- MD5 33cf5e629bcc89e9f004aea4fa052096
- SHA1 0d79692427643d7dd58258e6d9d43509b41b9fa0
- SHA512 b1ff521f08de9bdff39b431fde7f2686a4ea8339fce9ed9fc6f901463bda31135ac1d90daa90b4c940cc774af0c266da83753562a48223f3e7db4ccebb9a763f
- SSDEEP 12288:/yYo0BUuMB/VmIpfWDMuvPwvmkfr3SgyXIKcOzN+IldpxvhvviFbJgdm8TIxAqOz:6Yo0QJDODvqZKcyrpxvh1UdOAugq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ = "Banco do Brasil S.A." regsvr32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\33cf5e629bcc89e9f004aea4fa052096_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ = "GbiehObj Class" regsvr32.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1168 regsvr32.exe Token: SeSecurityPrivilege 1168 regsvr32.exe Token: SeTakeOwnershipPrivilege 1168 regsvr32.exe Token: SeLoadDriverPrivilege 1168 regsvr32.exe Token: SeSystemProfilePrivilege 1168 regsvr32.exe Token: SeSystemtimePrivilege 1168 regsvr32.exe Token: SeProfSingleProcessPrivilege 1168 regsvr32.exe Token: SeIncBasePriorityPrivilege 1168 regsvr32.exe Token: SeCreatePagefilePrivilege 1168 regsvr32.exe Token: SeShutdownPrivilege 1168 regsvr32.exe Token: SeDebugPrivilege 1168 regsvr32.exe Token: SeSystemEnvironmentPrivilege 1168 regsvr32.exe Token: SeRemoteShutdownPrivilege 1168 regsvr32.exe Token: SeUndockPrivilege 1168 regsvr32.exe Token: SeManageVolumePrivilege 1168 regsvr32.exe Token: 33 1168 regsvr32.exe Token: 34 1168 regsvr32.exe Token: 35 1168 regsvr32.exe Token: 36 1168 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3264 wrote to memory of 1168 3264 regsvr32.exe 81 PID 3264 wrote to memory of 1168 3264 regsvr32.exe 81 PID 3264 wrote to memory of 1168 3264 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\33cf5e629bcc89e9f004aea4fa052096_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\33cf5e629bcc89e9f004aea4fa052096_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1168
-