Analysis
-
max time kernel
136s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 11:02
Static task
static1
Behavioral task
behavioral1
Sample
73c56b67cde9fc286c21a9db4e985a64_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
73c56b67cde9fc286c21a9db4e985a64_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
73c56b67cde9fc286c21a9db4e985a64_JaffaCakes118.dll
-
Size
104KB
-
MD5
73c56b67cde9fc286c21a9db4e985a64
-
SHA1
4d362769c564ebb5f4e9097c49e9f71cb56b3f80
-
SHA256
669efd43aef27d963a06517e36cd97b1aa11861f0498241043e1b47809a225d2
-
SHA512
c6d1a9b14cc17036486f8dadac2786618e414370f1114ef9253f3fd35e4834dd192f88fea8da0e05dc55b0762f6f0445095f14593e2f4743eca8b33590793f43
-
SSDEEP
3072:jLCudzzegDgxXee5/Umz2lG32ER47BVFOq0K10C8Rn:j/z45/Uk2M3Q7JOFKw
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CustomComposition = "{064e4a31-6e66-44c4-9200-604daaa8c605}" regsvr32.exe -
Loads dropped DLL 2 IoCs
pid Process 4776 regsvr32.exe 4776 regsvr32.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Custom\CustomComposition.dll regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{064e4a31-6e66-44c4-9200-604daaa8c605}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{064e4a31-6e66-44c4-9200-604daaa8c605}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Custom\\CustomComposition.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{064e4a31-6e66-44c4-9200-604daaa8c605}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{064e4a31-6e66-44c4-9200-604daaa8c605} regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4776 regsvr32.exe 4776 regsvr32.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4776 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4776 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2400 wrote to memory of 4776 2400 regsvr32.exe 84 PID 2400 wrote to memory of 4776 2400 regsvr32.exe 84 PID 2400 wrote to memory of 4776 2400 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\73c56b67cde9fc286c21a9db4e985a64_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\73c56b67cde9fc286c21a9db4e985a64_JaffaCakes118.dll2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD573c56b67cde9fc286c21a9db4e985a64
SHA14d362769c564ebb5f4e9097c49e9f71cb56b3f80
SHA256669efd43aef27d963a06517e36cd97b1aa11861f0498241043e1b47809a225d2
SHA512c6d1a9b14cc17036486f8dadac2786618e414370f1114ef9253f3fd35e4834dd192f88fea8da0e05dc55b0762f6f0445095f14593e2f4743eca8b33590793f43