Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 08:12
Behavioral task
behavioral1
Sample
6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.dll
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.dll
-
Size
224KB
-
MD5
6ae0a68b7423964af8d798d107a4326a
-
SHA1
b841849c19f9504d49eb47b1c964ac159dfb2d79
-
SHA256
e4994a7b260e697a8840efd5a92f866e365e225129a46330d272ea1a6f400c22
-
SHA512
32d968bbddbd3ba415da7529ffbb182991da2a346d36dbadfaabd3a63a041dd80c6f7a5bee7eb7f8e9ff2056abcf9a724440c02939d76a9fddf6dee13ae94a5a
-
SSDEEP
6144:Hwx/C2G6SDG6dphYB365sryrXlsnVUGohVH5:HwHG6SD/ac5sruXeVNoT5
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1528-0-0x0000000000400000-0x0000000000498000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5} regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.sb\Clsid\ = "{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}\ProgID\ = "6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.sb" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}\ = "sb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.sb regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.sb\ = "sb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.sb\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-47F8-BE53-A62C-6FAC5A17C6F5} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1528 3640 regsvr32.exe 84 PID 3640 wrote to memory of 1528 3640 regsvr32.exe 84 PID 3640 wrote to memory of 1528 3640 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6ae0a68b7423964af8d798d107a4326a_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1528
-