Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll
-
Size
573KB
-
MD5
7058abeb6f7d4a69c47fd8fa59a0abcf
-
SHA1
64626a76a5f0d8629c67bc1d0e08f09ad0121484
-
SHA256
38e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18
-
SHA512
ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206
-
SSDEEP
12288:q87H3sH2k/es9A9tqKsuud0/l0pT7fEztxG9HBMbVNAzirS:qSs7/3Ytq4E3MzO9HoHos
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
81.241.252.59:2078
76.25.142.196:443
89.101.97.139:443
217.17.56.163:0
185.250.148.74:443
174.54.58.170:443
73.130.180.25:443
73.52.50.32:443
174.59.35.191:443
181.118.183.94:443
120.150.218.241:995
73.230.205.91:443
174.54.193.186:443
136.232.34.70:443
71.74.12.34:443
95.77.223.148:443
103.148.120.144:443
75.188.35.168:443
39.52.213.1:995
45.46.53.140:2222
73.151.236.31:443
173.21.10.71:2222
24.34.58.116:443
62.23.194.38:443
62.23.194.41:995
47.40.196.233:2222
67.165.206.193:993
72.252.201.69:443
173.25.166.81:443
199.27.127.129:443
68.204.7.158:443
191.191.38.8:443
109.12.111.14:443
24.139.72.117:443
24.229.150.54:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
81.250.153.227:2222
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
24.55.112.61:443
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
103.157.122.198:995
217.165.163.21:995
77.57.204.78:443
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
186.87.135.68:995
80.6.192.58:443
75.66.88.33:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.116.91:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ubdrcy = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Nqlgevhcoyji = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 884 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exeexplorer.exeschtasks.exeregsvr32.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\5ada1339 = 95d459578eb3f81f90704b262d84cfadd96267f60417c54ca314e87065e80c58 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\6f45c377 = 017f8f86580ae2cd7e501b598a5ab1e8374ea98421ce10ca9850d64c4ca92658a463c5bd05381363df9a680236ce17bd697cb0279a54a6628459e285807a9e4ee2f0f04c9e3728871559c0df301144f0feaab5a0fccf6b8abf518d6b3aaf955edbac8f66d3cc9086e0a7a575e834ad4c1277fab2398899e92896c0421dafc80b23475825147736cfe37c9a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\6d04e30b = dac1b6a25f84a12bebc469d07fbdc74b0bcda8c8812eb36855c68b2afccedff2b2fd12172ca0e0a5c593d4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\d5b8846e = a08ad0c1c4d060f1f0e1b062fb11b05339e4217a387e105f9a383188ea4dac57830872ff950c9fcea5cc12c6aa31d74f8a3c64c802d08bfbf7ee49480aa43c9b7a2c7e912486174ac0b592317a5b82ef6fd040c4cbc1272b07162044e48c5c10ca909ba3e1b6500c6c58c0333fdb4019b2f1e9 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\d7f9a412 = 551facd3f3664a9ab4928197963800a572765e3b1626486d1eceea6aa5f9a35e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\25937ccf = 5a08a378fcfde746230da63c2f95f9154a9a27352e5cf3e78231211f95fb43f24a8817822dcd0c762b1cc6ac30 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\a8b0cbe4 = 0fdb528cd025e6088d5f31ac8ace994344074c79be53e3a9dcabbfc499fda512f8d07687d717ded21760e4442f4300f69f0ba027038bcc59d2e5c537879b43151e3281e65a506bd04d50047d4521bc6bc92e1e3422dd28a3b8dc152f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\100cac81 = e4728d942cc1d33197de3648402af168a871b26fa372f880e8cbb5e38464b829e1725fd39741 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Zdnmwkdo\5ada1339 = 95d44e578eb3cda181d6e0bf88ebc6ed7691e3058f76228bebd9690efbd855fc24809683f791a4dda6a5eb6187d82e1909b72f9642 explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2388 rundll32.exe 2388 rundll32.exe 884 regsvr32.exe 884 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2388 rundll32.exe 884 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1968 wrote to memory of 2388 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2388 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2388 1968 rundll32.exe rundll32.exe PID 2388 wrote to memory of 1552 2388 rundll32.exe explorer.exe PID 2388 wrote to memory of 1552 2388 rundll32.exe explorer.exe PID 2388 wrote to memory of 1552 2388 rundll32.exe explorer.exe PID 2388 wrote to memory of 1552 2388 rundll32.exe explorer.exe PID 2388 wrote to memory of 1552 2388 rundll32.exe explorer.exe PID 1552 wrote to memory of 3464 1552 explorer.exe schtasks.exe PID 1552 wrote to memory of 3464 1552 explorer.exe schtasks.exe PID 1552 wrote to memory of 3464 1552 explorer.exe schtasks.exe PID 432 wrote to memory of 884 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 884 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 884 432 regsvr32.exe regsvr32.exe PID 884 wrote to memory of 1824 884 regsvr32.exe explorer.exe PID 884 wrote to memory of 1824 884 regsvr32.exe explorer.exe PID 884 wrote to memory of 1824 884 regsvr32.exe explorer.exe PID 884 wrote to memory of 1824 884 regsvr32.exe explorer.exe PID 884 wrote to memory of 1824 884 regsvr32.exe explorer.exe PID 1824 wrote to memory of 4104 1824 explorer.exe reg.exe PID 1824 wrote to memory of 4104 1824 explorer.exe reg.exe PID 1824 wrote to memory of 5064 1824 explorer.exe reg.exe PID 1824 wrote to memory of 5064 1824 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pionqcxt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll\"" /SC ONCE /Z /ST 16:35 /ET 16:474⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3464
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\7058abeb6f7d4a69c47fd8fa59a0abcf_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Nqlgevhcoyji" /d "0"4⤵
- Windows security bypass
PID:4104
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ubdrcy" /d "0"4⤵
- Windows security bypass
PID:5064
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD57058abeb6f7d4a69c47fd8fa59a0abcf
SHA164626a76a5f0d8629c67bc1d0e08f09ad0121484
SHA25638e719c1c9a05a97509a8fd8ed2a5b784839f945a211bddc7f7bbd9eb4b36c18
SHA512ba3eb479a00fb46d6bbbfd85bdcf0b55c2b4cdb3b4be9d5b804706b4e7dfd69a7291c4029bad3c40427193caed4b7b3dad18a5772b29abb51fce5dfec63d0206