Analysis
-
max time kernel
128s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 11:02
Behavioral task
behavioral1
Sample
95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
-
Target
95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll
-
Size
7KB
-
MD5
95d3e8a28f585caea44a696bbe80c065
-
SHA1
defe19c8aa857f1ba71c4c3b4ca414c041d96fe1
-
SHA256
28cf4ce194946329da547b7a8b01ad66643e6b0183a7ef95d45d2d701c1eedb2
-
SHA512
5ae92924bbd55a0fb414dcee8f68c6c3a7b7f139e78b707e579bd66a98e18eb64b4728a3355e5316e2d0ef08b1a470a7b0bec500add9b09dcea6ee85f4755583
-
SSDEEP
192:id9piB3B5PPICyjBCco5jLudg1dqycMc:O9pCB5PPNGB6XuGDqH
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\ regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\ddd = "ddd" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2808 3408 regsvr32.exe 84 PID 3408 wrote to memory of 2808 3408 regsvr32.exe 84 PID 3408 wrote to memory of 2808 3408 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2808
-