Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll
-
Size
573KB
-
MD5
7058abeb6f7d4a69c47fd8fa59a0abcf
-
SHA1
64626a76a5f0d8629c67bc1d0e08f09ad0121484
-
SHA256
38e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18
-
SHA512
ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206
-
SSDEEP
12288:q87H3sH2k/es9A9tqKsuud0/l0pT7fEztxG9HBMbVNAzirS:qSs7/3Ytq4E3MzO9HoHos
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
81.241.252.59:2078
76.25.142.196:443
89.101.97.139:443
217.17.56.163:0
185.250.148.74:443
174.54.58.170:443
73.130.180.25:443
73.52.50.32:443
174.59.35.191:443
181.118.183.94:443
120.150.218.241:995
73.230.205.91:443
174.54.193.186:443
136.232.34.70:443
71.74.12.34:443
95.77.223.148:443
103.148.120.144:443
75.188.35.168:443
39.52.213.1:995
45.46.53.140:2222
73.151.236.31:443
173.21.10.71:2222
24.34.58.116:443
62.23.194.38:443
62.23.194.41:995
47.40.196.233:2222
67.165.206.193:993
72.252.201.69:443
173.25.166.81:443
199.27.127.129:443
68.204.7.158:443
191.191.38.8:443
109.12.111.14:443
24.139.72.117:443
24.229.150.54:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
81.250.153.227:2222
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
24.55.112.61:443
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
103.157.122.198:995
217.165.163.21:995
77.57.204.78:443
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
186.87.135.68:995
80.6.192.58:443
75.66.88.33:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.116.91:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Ncfpj = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Iplzqqgw = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2876 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\d6b27b73 = 0d13074f33c980fd91483520a5a0 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\6e0e1c16 = eafcfbe32471523e3a2f24562d07c9f48f1245a1ab942cb0a7466d99506653a9b97767ab5874823082bc33260318d30881a8c6e4f0ec258efeea03c611393b2fbbf2cfb7c81ea92e49b0a78ad7781f49a942c7823e97f95a4a79f162af0966fe60afc17ce14f56 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\6c4f3c6a = 487b262a4ac2af05ce0532280bb6227ee270e55f6f6cd3e10cb862bc5dec99992ce9a5aad058e1f549cbaf55eeb9b49e0eec1f4903ca142e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\114773e0 = aa6c8db1792f06bddcf79eb7b42b2e94aba3ba62bdf2c82d83123d6c58e37849e7053b3b39912a1ae2b2c0a48bf516c23721318cfea4210241fa5f0279f4ef889b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\24d8a3ae = 90670e854b14c2120f5563d55da0ba2374940f250a0f101927bd7b7827455df383e562c8360ed2e8b6fdecdeb5b4e5697d672c01ad243f6fe470461bd627df25084734a19b8ff418d2ba3f67f1b39b1b60ffd0fdbfe2b7dc8b2cce3f3f21c3889bc08c explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\5b91cc58 = a09f0eaf264840c678e0ed234300e9c8e9f0c0f09209dc468858e8becc3be0271ba7e9dc82eb2cec01ee94d55a5feb937dc52b29501a007f2011604f0dd21c1111573531e163617ec7b81f7dd73356572af22b41b02559a4441564af03f782c98f92fadcb9fce0954a8d7d4c6c0a7094b69c0760fca4121d02e9b5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\5b91cc58 = a09f19af264875d8d967de2aa0f18d91f15af8d3620fbd70d7745060fb7ff2edb9fc5543fc337fd50cafd3e61c93696f1dd3a899b4ddc7460bbfe19c072037c11d288e54d981e8a59c40c25e9d1fbde51bb90d77e5a0639d625d96f0ad5ffc4927d4899e8402 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\d4f35b0f = 28b96db747a7c382faa3549d7bb8be3a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Yukaeetpdr\a9fb1485 = 860dd6e6577bedee50bbf5400efcc4c759cc1a200b76aaa7a0f2eb49e163c4e084ab532fa5e525125bc8cf811ad224f2 explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 3048 rundll32.exe 2876 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 3048 rundll32.exe 2876 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 2888 wrote to memory of 3048 2888 rundll32.exe rundll32.exe PID 3048 wrote to memory of 2684 3048 rundll32.exe explorer.exe PID 3048 wrote to memory of 2684 3048 rundll32.exe explorer.exe PID 3048 wrote to memory of 2684 3048 rundll32.exe explorer.exe PID 3048 wrote to memory of 2684 3048 rundll32.exe explorer.exe PID 3048 wrote to memory of 2684 3048 rundll32.exe explorer.exe PID 3048 wrote to memory of 2684 3048 rundll32.exe explorer.exe PID 2684 wrote to memory of 2704 2684 explorer.exe schtasks.exe PID 2684 wrote to memory of 2704 2684 explorer.exe schtasks.exe PID 2684 wrote to memory of 2704 2684 explorer.exe schtasks.exe PID 2684 wrote to memory of 2704 2684 explorer.exe schtasks.exe PID 1580 wrote to memory of 2860 1580 taskeng.exe regsvr32.exe PID 1580 wrote to memory of 2860 1580 taskeng.exe regsvr32.exe PID 1580 wrote to memory of 2860 1580 taskeng.exe regsvr32.exe PID 1580 wrote to memory of 2860 1580 taskeng.exe regsvr32.exe PID 1580 wrote to memory of 2860 1580 taskeng.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2860 wrote to memory of 2876 2860 regsvr32.exe regsvr32.exe PID 2876 wrote to memory of 2548 2876 regsvr32.exe explorer.exe PID 2876 wrote to memory of 2548 2876 regsvr32.exe explorer.exe PID 2876 wrote to memory of 2548 2876 regsvr32.exe explorer.exe PID 2876 wrote to memory of 2548 2876 regsvr32.exe explorer.exe PID 2876 wrote to memory of 2548 2876 regsvr32.exe explorer.exe PID 2876 wrote to memory of 2548 2876 regsvr32.exe explorer.exe PID 2548 wrote to memory of 2188 2548 explorer.exe reg.exe PID 2548 wrote to memory of 2188 2548 explorer.exe reg.exe PID 2548 wrote to memory of 2188 2548 explorer.exe reg.exe PID 2548 wrote to memory of 2188 2548 explorer.exe reg.exe PID 2548 wrote to memory of 1972 2548 explorer.exe reg.exe PID 2548 wrote to memory of 1972 2548 explorer.exe reg.exe PID 2548 wrote to memory of 1972 2548 explorer.exe reg.exe PID 2548 wrote to memory of 1972 2548 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn znlvjct /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll\"" /SC ONCE /Z /ST 16:38 /ET 16:504⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2704
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {88790EA7-A38B-4546-8B70-DD6632CB1C6C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ncfpj" /d "0"5⤵
- Windows security bypass
PID:2188
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iplzqqgw" /d "0"5⤵
- Windows security bypass
PID:1972
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD57058abeb6f7d4a69c47fd8fa59a0abcf
SHA164626a76a5f0d8629c67bc1d0e08f09ad0121484
SHA25638e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18
SHA512ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206