Overview
overview
10Static
static
3efa8c87419...18.exe
windows7-x64
10efa8c87419...18.exe
windows10-2004-x64
10$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDIR/LogEx.dll
windows7-x64
3$PLUGINSDIR/LogEx.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3i386/SSCbF...f3.dll
windows7-x64
10i386/SSCbF...f3.dll
windows10-2004-x64
10i386/SSCbF...r3.dll
windows7-x64
3i386/SSCbF...r3.dll
windows10-2004-x64
3i386/sscbfs3.sys
windows7-x64
1i386/sscbfs3.sys
windows10-2004-x64
1wow64sup.exe
windows7-x64
wow64sup.exe
windows10-2004-x64
x64/SSCbFsMntNtf3.dll
windows7-x64
10x64/SSCbFsMntNtf3.dll
windows10-2004-x64
10x64/SSCbFsNetRdr3.dll
windows7-x64
1x64/SSCbFsNetRdr3.dll
windows10-2004-x64
1x64/sscbfs3.sys
windows7-x64
1x64/sscbfs3.sys
windows10-2004-x64
1$PLUGINSDI...st.dll
windows7-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
efa8c874193d8e6d16c1a27affd58d6d_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
efa8c874193d8e6d16c1a27affd58d6d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LogEx.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LogEx.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
i386/SSCbFsMntNtf3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
i386/SSCbFsMntNtf3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
i386/SSCbFsNetRdr3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
i386/SSCbFsNetRdr3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
i386/sscbfs3.sys
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
i386/sscbfs3.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
wow64sup.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
wow64sup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
x64/SSCbFsMntNtf3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
x64/SSCbFsMntNtf3.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
x64/SSCbFsNetRdr3.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
x64/SSCbFsNetRdr3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
x64/sscbfs3.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
x64/sscbfs3.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/cbfsinst.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/cbfsinst.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
x64/SSCbFsMntNtf3.dll
-
Size
160KB
-
MD5
c9940a2b243ec73ade7a65e4572fde6b
-
SHA1
c4bd632f0135d75e7adf94f02fba22c6a9ff7342
-
SHA256
7bf8ea86624b461767ddf5573cfe9a55814efa6f67d808c1d91c61a45cd06466
-
SHA512
a8589e417cdaa42161eeb9af4aa104b4b7232e6333498cbe9e1e6b8090399b3f97471f1099fb051385142e051a8f82c834e2b8b0d3882b72ba74bff16b7a01b2
-
SSDEEP
3072:HCIOd79Gi8PcOocNMx3FiTrMIntrqzbp1Algnif+G/CaWLEuA4:HCIOdpn8PcOoH3FiTQIntmGDLWLbA4
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\EldosMountNotificator = "{C28617FD-4FE7-4043-AD51-C8132CE90106}" regsvr32.exe -
Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{C28617FD-4FE7-4043-AD51-C8132CE90106} = "Virtual Storage Mount Notification" regsvr32.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 62 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\AppID = "{A0CEE1D2-71DC-49CD-AF11-087292B8303A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\ = "VSMntNtf 2.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\VersionIndependentProgID\ = "SSVSMntNtf.SSVSMntNtfOverlayIcon" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\SSCbFsMntNtf3.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SSCbFsMntNtf3.dll regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\SSCbFsMntNtf3.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A0CEE1D2-71DC-49CD-AF11-087292B8303A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\TypeLib\ = "{C11574EB-F135-40F4-B341-9B29412BA733}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ = "IVSMntNtfOverlayIcon" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\ = "{239FDE2C-A916-45FB-91FA-78C905F3CE56}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\ = "SSVSMntNtfOverlayIcon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\VersionIndependentProgID\ = "SSVSMntNtf.MountShlExt" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\TypeLib\ = "{2A2336CC-D779-4C37-9F96-6A2E795C607E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1\CLSID\ = "{69925D1B-6A0F-4413-861A-81AB98039DB9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\ = "SSVSMntNtfOverlayIcon Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CurVer\ = "SSVSMntNtf.SSVSMntNtfOverlayIcon.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SSCbFsMntNtf3.dll\AppID = "{A0CEE1D2-71DC-49CD-AF11-087292B8303A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\ = "Virtual Storage Mount Notification" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\AppID = "{A0CEE1D2-71DC-49CD-AF11-087292B8303A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1\ = "SSVSMntNtfOverlayIcon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A0CEE1D2-71DC-49CD-AF11-087292B8303A}\ = "SSVSMntNtf" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\SSCbFsMntNtf3.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\ = "{239FDE2C-A916-45FB-91FA-78C905F3CE56}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CLSID\ = "{69925D1B-6A0F-4413-861A-81AB98039DB9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\ProgID\ = "SSVSMntNtf.SSVSMntNtfOverlayIcon.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ = "IVSMntNtfOverlayIcon" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE} regsvr32.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1