Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll
-
Size
690KB
-
MD5
0f7e92b27db58a84114aca132062e98b
-
SHA1
330f90ae520483e47b163f8425a1f9fa074ed4a6
-
SHA256
b67fa7aa75df8ac6c3c63effcac744b675028fc7b57384bbc69b5f6134522abb
-
SHA512
903b3d4d52d68b2455b4035147ca4943022ab342f963ae7f54bc46d3778c8454757f2a19a04d6eeedd2047757c0fd9db4544643b880f558e2bd108fffc4d0ccf
-
SSDEEP
12288:QdR3x1PT2kmudWlL4IDvTaA4k+vX5W03/Lp7UMnV6Q8:Qj6km0WSIDvTam+vX5W0PTV6J
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2796 regsvr32mgr.exe -
Loads dropped DLL 4 IoCs
pid Process 2712 regsvr32.exe 2712 regsvr32.exe 2796 regsvr32mgr.exe 2796 regsvr32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral1/memory/2796-11-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/2796-18-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2780 2796 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 1364 wrote to memory of 2712 1364 regsvr32.exe 30 PID 2712 wrote to memory of 2796 2712 regsvr32.exe 31 PID 2712 wrote to memory of 2796 2712 regsvr32.exe 31 PID 2712 wrote to memory of 2796 2712 regsvr32.exe 31 PID 2712 wrote to memory of 2796 2712 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 1804⤵
- Program crash
PID:2780
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
Filesize
157KB
MD51dcfb79162fe6a7047b30f1446c2fae5
SHA19c0296da3f5344a7e933c57e7d427c4de1a53bb4
SHA2563c6033da9f18e528997cedfd12dfb4f76ee6124e675965f379201777a02d5655
SHA512c405b032da32dfb1c4d5bd1175ddf8f0a72849fa4d83cc3342c6e43897ec4766a43832288ac9ba8b892d176fe9584bd518d8c6d09860b61eb3af83670ae33a91