Overview
overview
7Static
static
7df25e66ce5...18.exe
windows7-x64
3df25e66ce5...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...l0.dll
windows7-x64
7$PLUGINSDI...l0.dll
windows10-2004-x64
7$PLUGINSDI...02.dll
windows7-x64
3$PLUGINSDI...02.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$R0.dll
windows7-x64
3$R0.dll
windows10-2004-x64
3$SYSDIR/msvcp60.dll
windows7-x64
3$SYSDIR/msvcp60.dll
windows10-2004-x64
3$_39_/Riched32.dll
windows7-x64
3$_39_/Riched32.dll
windows10-2004-x64
3$_39_/riched20.dll
windows7-x64
3$_39_/riched20.dll
windows10-2004-x64
3Mfc42.dll
windows7-x64
3Mfc42.dll
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 00:15
Behavioral task
behavioral1
Sample
df25e66ce5ec0eba910aae3d82d7f50b_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df25e66ce5ec0eba910aae3d82d7f50b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/MyInstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/MyInstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/ProcDll0.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/ProcDll0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/QQDoctorHelper02.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/QQDoctorHelper02.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/QQDownHelper.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/QQDownHelper.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/QQUIHelper.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/QQUIHelper.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/SysHelper.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/SysHelper.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/SysVer.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/SysVer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/VerDll.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/VerDll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$R0.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$R0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$SYSDIR/msvcp60.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$SYSDIR/msvcp60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$_39_/Riched32.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$_39_/Riched32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$_39_/riched20.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$_39_/riched20.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Mfc42.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Mfc42.dll
Resource
win10v2004-20240802-en
General
-
Target
$R0.dll
-
Size
45KB
-
MD5
f53ac3535a49a12a3c26a45f544686c5
-
SHA1
550c19bd2330d33c8ece8097cdb74395afabec62
-
SHA256
8e2a59c5cdc7552a397b804b1f9c80dd47c72c955d03439a29aec72bd80b24fb
-
SHA512
c4b4307ff33545f8772457e423e7330b0b63c1fa63e41e830fb3d3d360e267e41312c8579c0ba13833eff4b401e91a259db0cc5160b00d3447c1b82d6329f128
-
SSDEEP
384:llu+Bl6l6FQhhDGO/duEr/G/yZNfYG0vMIFx6X+kvzEEldRat1YmfYvqyUiOYJLK:lw+BQnhFX2/Amx6dbE2at1YmfoVLXbap
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QQCPHelper.CPAdder regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D}\ = "QQCPHelper.CPAdder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D}\ProgID\ = "QQCPHelper.CPAdder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QQCPHelper.CPAdder\ = "QQCPHelper.CPAdder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QQCPHelper.CPAdder\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QQCPHelper.CPAdder\CLSID\ = "{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23752AA7-CAD7-40C2-99EE-7A9CD3C20C6D}\ProgID regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31 PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31 PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31 PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31 PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31 PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31 PID 2380 wrote to memory of 2316 2380 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\$R0.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2316
-