Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 21:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5db5374f9b4dc62927cf32a2bdeeaf08_JaffaCakes118.dll
Resource
win7-20240705-en
3 signatures
150 seconds
General
-
Target
5db5374f9b4dc62927cf32a2bdeeaf08_JaffaCakes118.dll
-
Size
44KB
-
MD5
5db5374f9b4dc62927cf32a2bdeeaf08
-
SHA1
24e406863100161cba72031e9284e335b96cd9f4
-
SHA256
46398d071cc17b6da3f9afd144f36ad6ac736b8f6bb62506833a8cfadf61ea71
-
SHA512
9c08cf9fc4a4e0ddd3ded0d7771143edf8067f34cf4d36e5b252e39b80ee95f1c979f1a1a2796706c0dc5dc7fa526a7741410fe4d86c5cfac153cc84fe229d2f
-
SSDEEP
768:HOQdhtlLfDoDi+zVvxOHZMGk61hh7xgVLE9AvJ:HXzzsDi0vy8ah7xgC9K
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CF456C5-BAC8-441C-8C9F-861BFFDC0721} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8CF456C5-BAC8-441C-8C9F-861BFFDC0721}\NoExplorer = "1" regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF456C5-BAC8-441C-8C9F-861BFFDC0721}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF456C5-BAC8-441C-8C9F-861BFFDC0721} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CF456C5-BAC8-441C-8C9F-861BFFDC0721}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5db5374f9b4dc62927cf32a2bdeeaf08_JaffaCakes118.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 2576 wrote to memory of 1072 2576 regsvr32.exe 31 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32 PID 1072 wrote to memory of 2568 1072 regsvr32.exe 32
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5db5374f9b4dc62927cf32a2bdeeaf08_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5db5374f9b4dc62927cf32a2bdeeaf08_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5db5374f9b4dc62927cf32a2bdeeaf08_JaffaCakes118.dll",DllGetObjectType3⤵PID:2568
-
-