Analysis
-
max time kernel
141s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 06:17
Behavioral task
behavioral1
Sample
4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe
-
Size
62KB
-
MD5
4892c9fe3e40d6a1a16700ab20bd7ad6
-
SHA1
0392963fa5a99a617bef7e71fd09e52f3d75ab61
-
SHA256
e42ec0f79253a581a0f4fc18a671f83880ca1c207921429b2585d7abcaff9adc
-
SHA512
a299d8ab695e0b4e0a302aa8b2e0048d30863421ec26a026c595686df29cc8d327f9b561e7baaaf4a2808445efba6f06663d369ad840c6477f7a2fe3e506ce0c
-
SSDEEP
1536:QMxJi4NXE8ZhT7sFi8KYaiCGUysbTWUDYROo0H9Hti+:VxJlhpZZGMi9UpbSVROJtti
Score
8/10
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2996 attrib.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0004000000004ed7-6.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2656 regsvr32.exe -
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x0004000000004ed7-6.dat upx behavioral1/memory/2656-8-0x0000000010000000-0x000000001000C000-memory.dmp upx behavioral1/memory/1720-13-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1720-19-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe" 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\NoExplorer = "1" 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10E1725C-7237-41A9-954A-04DCCB1FD16C} 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\NoExplorer = "1" 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{10E1725C-7237-41A9-954A-04DCCB1FD16C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\2211.dll 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\2211.dll attrib.exe File opened for modification C:\Windows\SysWOW64\MC_S1.jpg 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MC_S2.jpg 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MC_S3.jpg 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CurVer\ = "BhoPlugin.EyeOnIE.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\ProgID\ = "BhoPlugin.EyeOnIE.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\ = "BhoPlugin 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\laji\dllname = "2211" 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CLSID\ = "{10E1725C-7237-41A9-954A-04DCCB1FD16C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\InprocServer32\ = "C:\\Windows\\SysWow64\\2211.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\ = "IEyeOnIE" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\TypeLib\ = "{3C8BF053-0A65-46FE-A757-2187BD66EF34}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\HELPDIR\ = "C:\\Windows\\system32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\ = "IEyeOnIE" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\ = "EyeOnIE Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\VersionIndependentProgID\ = "BhoPlugin.EyeOnIE" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\CLSID\ = "{10E1725C-7237-41A9-954A-04DCCB1FD16C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\laji 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\2211.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{49859A6F-2284-4F06-9F8E-BFE56B35BA09}\TypeLib\ = "{3C8BF053-0A65-46FE-A757-2187BD66EF34}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3C8BF053-0A65-46FE-A757-2187BD66EF34}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\ = "EyeOnIE Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10E1725C-7237-41A9-954A-04DCCB1FD16C}\TypeLib\ = "{3C8BF053-0A65-46FE-A757-2187BD66EF34}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\ = "EyeOnIE Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1720 wrote to memory of 3052 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 31 PID 1720 wrote to memory of 3052 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 31 PID 1720 wrote to memory of 3052 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 31 PID 1720 wrote to memory of 3052 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 31 PID 3052 wrote to memory of 1072 3052 cmd.exe 33 PID 3052 wrote to memory of 1072 3052 cmd.exe 33 PID 3052 wrote to memory of 1072 3052 cmd.exe 33 PID 3052 wrote to memory of 1072 3052 cmd.exe 33 PID 3052 wrote to memory of 2296 3052 cmd.exe 34 PID 3052 wrote to memory of 2296 3052 cmd.exe 34 PID 3052 wrote to memory of 2296 3052 cmd.exe 34 PID 3052 wrote to memory of 2296 3052 cmd.exe 34 PID 1720 wrote to memory of 2988 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 35 PID 1720 wrote to memory of 2988 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 35 PID 1720 wrote to memory of 2988 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 35 PID 1720 wrote to memory of 2988 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 35 PID 1720 wrote to memory of 2996 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 37 PID 1720 wrote to memory of 2996 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 37 PID 1720 wrote to memory of 2996 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 37 PID 1720 wrote to memory of 2996 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 37 PID 1720 wrote to memory of 2564 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 39 PID 1720 wrote to memory of 2564 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 39 PID 1720 wrote to memory of 2564 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 39 PID 1720 wrote to memory of 2564 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 39 PID 2564 wrote to memory of 2648 2564 cmd.exe 41 PID 2564 wrote to memory of 2648 2564 cmd.exe 41 PID 2564 wrote to memory of 2648 2564 cmd.exe 41 PID 2564 wrote to memory of 2648 2564 cmd.exe 41 PID 2564 wrote to memory of 2684 2564 cmd.exe 42 PID 2564 wrote to memory of 2684 2564 cmd.exe 42 PID 2564 wrote to memory of 2684 2564 cmd.exe 42 PID 2564 wrote to memory of 2684 2564 cmd.exe 42 PID 1720 wrote to memory of 2612 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 43 PID 1720 wrote to memory of 2612 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 43 PID 1720 wrote to memory of 2612 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 43 PID 1720 wrote to memory of 2612 1720 4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe 43 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 PID 2612 wrote to memory of 2656 2612 cmd.exe 45 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2988 attrib.exe 2996 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4892c9fe3e40d6a1a16700ab20bd7ad6_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|cacls C:\Windows\system32\2211.dll /g everyone:f2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1072
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\2211.dll /g everyone:f3⤵PID:2296
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" -r -a -s -h C:\Windows\system32\2211.dll2⤵
- Views/modifies file attributes
PID:2988
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +r +a +s +h C:\Windows\system32\2211.dll2⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|cacls C:\Windows\system32\2211.dll /g everyone:r2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2648
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\2211.dll /g everyone:r3⤵PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c regsvr32 /s C:\Windows\system32\2211.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\system32\2211.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5515c313e509efb6e2178f917e1717bf5
SHA13d786d280d77612e0dd6d8a93fbdeae5c99b47c5
SHA256e958ab82acf80579a7dbdd1d935e5b82757d9232dd94d3a2279eb5e74303e56f
SHA5123213c399038bb4537b6314f697dc76873ad4725f8de6d74ca63e42717f001130f0e58d30b26d11069b4e01c81beace9ff25fbbcc96f07bd8c256d64477ef535f