Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 20:53
Behavioral task
behavioral1
Sample
e3564138588cba04c873bd054458f8b9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e3564138588cba04c873bd054458f8b9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e3564138588cba04c873bd054458f8b9_JaffaCakes118.dll
-
Size
111KB
-
MD5
e3564138588cba04c873bd054458f8b9
-
SHA1
157ec7421e1333b714d01a750b6d5d6517a92c45
-
SHA256
e3932ab83bc05de2e91d321c4d479ff1aa3d10fdbd91e1687c80cc0ec88270e8
-
SHA512
2a2e8ce45a928bcffdb40ebf6559c1f071bb3feccfd9cfe355e593acb559ecf84858cf4474708d311317ab08b3f981eba7c8b80dceae973839a0eec9049665c8
-
SSDEEP
1536:3ui/9Xb791Wff4K84oeRnobxxm2ShclQaLMin8F5vAC+WEQbAmTjTpeyv0+gPzff:H/J7jWHT/oegcaQF5XEgHbpeyvfgT
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dodyugc = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Daubeg\\cyif.dll,DllRegisterServer" msiexec.exe -
Blocklisted process makes network request 5 IoCs
flow pid Process 33 928 msiexec.exe 36 928 msiexec.exe 42 928 msiexec.exe 45 928 msiexec.exe 49 928 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4756 set thread context of 928 4756 regsvr32.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 928 msiexec.exe Token: SeSecurityPrivilege 928 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4288 wrote to memory of 4756 4288 regsvr32.exe 82 PID 4288 wrote to memory of 4756 4288 regsvr32.exe 82 PID 4288 wrote to memory of 4756 4288 regsvr32.exe 82 PID 4756 wrote to memory of 928 4756 regsvr32.exe 90 PID 4756 wrote to memory of 928 4756 regsvr32.exe 90 PID 4756 wrote to memory of 928 4756 regsvr32.exe 90 PID 4756 wrote to memory of 928 4756 regsvr32.exe 90 PID 4756 wrote to memory of 928 4756 regsvr32.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e3564138588cba04c873bd054458f8b9_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e3564138588cba04c873bd054458f8b9_JaffaCakes118.dll2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-