Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll
-
Size
152KB
-
MD5
de3325f51141654328d9bacdf8ee01ef
-
SHA1
d3a1994d6fd85b5effcb35fa3196e98eb6282be4
-
SHA256
bdbbf38eb02746166ab87b669c73e99653a4f2912cf45149d817c3de07a0f19f
-
SHA512
cb6e4943b83c48f2c82cfa6f54c14c73916a473d7263e59a23685049225a7b9aa8b875ce5680e8b83bcc86b28666d28e891606e77124bcbae7b60cb689993e63
-
SSDEEP
3072:3fTEnn207xFOpQy+kSEs4aRXotUYExkd:3fTEnn20tFOpdLstplYs
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F} regsvr32.exe -
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\ = "Ibpsb" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\ProgID\ = "sgoblxtm.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\TypeLib\ = "{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.ToolBar.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.bpsb regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.bpsb\ = "sgoblxtm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.bpsb\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\ = "sgoblxtm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.ToolBar.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.ToolBar.1\ = "sgoblxtm" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\ = "sgoblxtm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\TypeLib\ = "{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.bpsb\CLSID\ = "{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\TypeLib\ = "{CBA0A72A-C5B0-47F8-9BD7-307B7708A58D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.ToolBar.1\CLSID\ = "{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.bpsb\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sgoblxtm.bpsb\CurVer\ = "sgoblxtm.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{57ABA3CE-E927-4C81-BE2E-E20CAEC6645F}\VersionIndependentProgID\ = "sgoblxtm" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D4C17E6-B0D7-4DE2-A128-67F2FA1D4FF6}\ = "Ibpsb" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30 PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30 PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30 PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30 PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30 PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30 PID 2640 wrote to memory of 2116 2640 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\de3325f51141654328d9bacdf8ee01ef_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:2116
-