Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll
-
Size
690KB
-
MD5
0f7e92b27db58a84114aca132062e98b
-
SHA1
330f90ae520483e47b163f8425a1f9fa074ed4a6
-
SHA256
b67fa7aa75df8ac6c3c63effcac744b675028fc7b57384bbc69b5f6134522abb
-
SHA512
903b3d4d52d68b2455b4035147ca4943022ab342f963ae7f54bc46d3778c8454757f2a19a04d6eeedd2047757c0fd9db4544643b880f558e2bd108fffc4d0ccf
-
SSDEEP
12288:QdR3x1PT2kmudWlL4IDvTaA4k+vX5W03/Lp7UMnV6Q8:Qj6km0WSIDvTam+vX5W0PTV6J
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4824 regsvr32mgr.exe -
Loads dropped DLL 1 IoCs
pid Process 4824 regsvr32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral2/memory/4824-7-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4808 4824 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 644 wrote to memory of 4756 644 regsvr32.exe 82 PID 644 wrote to memory of 4756 644 regsvr32.exe 82 PID 644 wrote to memory of 4756 644 regsvr32.exe 82 PID 4756 wrote to memory of 4824 4756 regsvr32.exe 83 PID 4756 wrote to memory of 4824 4756 regsvr32.exe 83 PID 4756 wrote to memory of 4824 4756 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0f7e92b27db58a84114aca132062e98b_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 5364⤵
- Program crash
PID:4808
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4824 -ip 48241⤵PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
157KB
MD51dcfb79162fe6a7047b30f1446c2fae5
SHA19c0296da3f5344a7e933c57e7d427c4de1a53bb4
SHA2563c6033da9f18e528997cedfd12dfb4f76ee6124e675965f379201777a02d5655
SHA512c405b032da32dfb1c4d5bd1175ddf8f0a72849fa4d83cc3342c6e43897ec4766a43832288ac9ba8b892d176fe9584bd518d8c6d09860b61eb3af83670ae33a91