2efe1867d9b06e0f2f6dfa1fcc2a29feb0a302626c4bf881e5815b2df826dc9c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 03:38

Target

ba35b6e8e8deda5045154673a5ff96f7_JaffaCakes118.dll
Size

157KB
MD5

ba35b6e8e8deda5045154673a5ff96f7
SHA1

ffaa872ec904d14c7cddab0f0b0b2b117a0028ab
SHA256

2efe1867d9b06e0f2f6dfa1fcc2a29feb0a302626c4bf881e5815b2df826dc9c
SHA512

9588fae80e876094a3efad79d282965701afdc7f2026742128b241390a8ecef2679c6e5ebed9f84e103b162b4d7ee52ce8ff946b370a9955a2b9123db05f0c5f
SSDEEP

3072:zSsewP6aUUzZqiw45H1lewzqtd75sIy4v5hA5E/0:2sewbl155ZqtJG2nA5E/

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\{ea1f1db6-333f-b6a1-4d90-1683987238ef} = "C:\\Windows\\System32\\Rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ba35b6e8e8deda5045154673a5ff96f7_JaffaCakes118.dll\" DllStart"	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

Modify Registry

Browser Extensions

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cceacd57-4bdb-6813-aca8-0fa715591d98}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{cceacd57-4bdb-6813-aca8-0fa715591d98}\NoExplorer = "\"\""	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cceacd57-4bdb-6813-aca8-0fa715591d98}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cceacd57-4bdb-6813-aca8-0fa715591d98}\ = "rightonadz browser optimizer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cceacd57-4bdb-6813-aca8-0fa715591d98}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cceacd57-4bdb-6813-aca8-0fa715591d98}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ba35b6e8e8deda5045154673a5ff96f7_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cceacd57-4bdb-6813-aca8-0fa715591d98}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30
PID 2060 wrote to memory of 2780	2060	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba35b6e8e8deda5045154673a5ff96f7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ba35b6e8e8deda5045154673a5ff96f7_JaffaCakes118.dll
  2⤵
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2780