Analysis
-
max time kernel
146s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2024 23:26
Static task
static1
Behavioral task
behavioral1
Sample
27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll
-
Size
573KB
-
MD5
27051275caf38adcf7677e7a955adfea
-
SHA1
cd2e048cec404185cdaeec25eb8f4a1879a4bfd0
-
SHA256
c415b005c35c6e337240e2e8fd6cbead3cc4d5d21be5b793175b75aae4b93536
-
SHA512
128d5f42d02711b84e3c5dee045495cf89c6cdec9a68644110fdb7556b60fc61d5c56f17c1c5956f0dc61bb34c444348c04c739bdc04ac9079829b2f0d1a74ce
-
SSDEEP
12288:R87H3sH2k/eJ9A9tqKsuud0Xl0pT7fEztxG9HBMbVNAbirS:RSs7/KYtqoE3MzO9HoHAs
Malware Config
Extracted
qakbot
402.363
obama107
1633078880
140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
81.241.252.59:2078
76.25.142.196:443
89.101.97.139:443
217.17.56.163:0
185.250.148.74:443
174.54.58.170:443
73.130.180.25:443
73.52.50.32:443
174.59.35.191:443
181.118.183.94:443
120.150.218.241:995
73.230.205.91:443
174.54.193.186:443
136.232.34.70:443
71.74.12.34:443
95.77.223.148:443
103.148.120.144:443
75.188.35.168:443
39.52.213.1:995
45.46.53.140:2222
73.151.236.31:443
173.21.10.71:2222
24.34.58.116:443
62.23.194.38:443
62.23.194.41:995
47.40.196.233:2222
67.165.206.193:993
72.252.201.69:443
173.25.166.81:443
199.27.127.129:443
68.204.7.158:443
191.191.38.8:443
109.12.111.14:443
24.139.72.117:443
24.229.150.54:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
81.250.153.227:2222
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
24.55.112.61:443
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
103.157.122.198:995
217.165.163.21:995
77.57.204.78:443
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
186.87.135.68:995
80.6.192.58:443
75.66.88.33:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.116.91:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Hzuoxfmrwkb = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Uizrakha = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1068 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
explorer.exeschtasks.exeregsvr32.exeexplorer.exerundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\94d7817f = ec4c643b3c120b8b09e2e86821df6e84ad697881ed93d6db5229f7de97c96fa241ddcb2a794e07fba9f58ac61a846aac2445bcd9cbe75be1f80200da7a508cbf2b3d5c6d85d64833fde42878adeb6634d47c878964f5dbe44c02600d27debf1101ad7be856d3470bb7eb78ba3e9102ad98eae9b9403c80e6c019febc168066ce5b49f87af0131bba3e68c453df934f7a77cffdfa99e127517ec4b5d627ac9c0b7cf1f418967db2df71b469d33dc630d33c35356a2088c879729c6b13d8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\2e2ac666 = a87d16b4e45728dd4f899fd84c53e823b29c53 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\2c6be61a = 00cc40cb0274af253b7f48b57b8a8c645375dfd546c015e73fe612f513ed47a373e7681bf5f2c240b5d5aa23690d57f415bd1edd7778be6196a4e01d0ece034e96a264d1b06c816fe965d5b0e62eb4dd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\a1485131 = 74c686c5b266318e1acad32834a7a78bd5508b29302e0da68a72358e7c6845c7b72770f451c541e51b97e5b7235a827ca7c3411a9c85949ac4b1f1745f8fda6b93137217e5aa32c68a5aa05b42841fc5b8a72e5cb3d17db35713441f0596f459 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\9696a103 = 7d3f74401d415b91a4a5e46964f9133330e4481e6314888c2830dac7ec39ed47a4edf3735d9d70e2a01c8252 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\532289ec = 6094f55d08949ac9b04a7c36d158b1b8ffbc99e69e5210b6622034d441bb8399ec8b1b6ef83036fd016dffe989d1176ef3d359fbf2de7bf81263330edc97f9b9f0a02c940daa7964d452a52a9daff3a1534476282ce1c530228a617e5db868c88f9649e704 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\eb9eee89 = be48e5a80ada384c1e331d492eb7fa11c1e993da2c84bfbc8c1cdc70419b1a4cc2d424457f2960d13fabfe2cd6710dd9b0c27c4d52ca078a55b23eec explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\de013ec7 = 05d6bb9a9c84996b2254f629df1689b15351dcf65a7a5d322bd4db59fc86c4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc\a1485131 = 74c691c5b26604110cf5739e3b276938a6b35ff67158df0e79b5c1cee396fba3584eff2cde052ebc87ac41ae1580451261fc164a9db90a1180f7dde2984057ee35f864886953ede4df57f0f20ad399c40c7f26541e128a2b9ee68037500ca435f6ce583f13200b54f682adbc11fee3a9354f5345a5 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Jyunrzbc explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 4628 rundll32.exe 4628 rundll32.exe 1068 regsvr32.exe 1068 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 4628 rundll32.exe 1068 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2896 wrote to memory of 4628 2896 rundll32.exe rundll32.exe PID 2896 wrote to memory of 4628 2896 rundll32.exe rundll32.exe PID 2896 wrote to memory of 4628 2896 rundll32.exe rundll32.exe PID 4628 wrote to memory of 60 4628 rundll32.exe explorer.exe PID 4628 wrote to memory of 60 4628 rundll32.exe explorer.exe PID 4628 wrote to memory of 60 4628 rundll32.exe explorer.exe PID 4628 wrote to memory of 60 4628 rundll32.exe explorer.exe PID 4628 wrote to memory of 60 4628 rundll32.exe explorer.exe PID 60 wrote to memory of 4544 60 explorer.exe schtasks.exe PID 60 wrote to memory of 4544 60 explorer.exe schtasks.exe PID 60 wrote to memory of 4544 60 explorer.exe schtasks.exe PID 1644 wrote to memory of 1068 1644 regsvr32.exe regsvr32.exe PID 1644 wrote to memory of 1068 1644 regsvr32.exe regsvr32.exe PID 1644 wrote to memory of 1068 1644 regsvr32.exe regsvr32.exe PID 1068 wrote to memory of 452 1068 regsvr32.exe explorer.exe PID 1068 wrote to memory of 452 1068 regsvr32.exe explorer.exe PID 1068 wrote to memory of 452 1068 regsvr32.exe explorer.exe PID 1068 wrote to memory of 452 1068 regsvr32.exe explorer.exe PID 1068 wrote to memory of 452 1068 regsvr32.exe explorer.exe PID 452 wrote to memory of 3248 452 explorer.exe reg.exe PID 452 wrote to memory of 3248 452 explorer.exe reg.exe PID 452 wrote to memory of 856 452 explorer.exe reg.exe PID 452 wrote to memory of 856 452 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zjdorksr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll\"" /SC ONCE /Z /ST 06:23 /ET 06:354⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4544
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\27051275caf38adcf7677e7a955adfea_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Uizrakha" /d "0"4⤵
- Windows security bypass
PID:3248 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hzuoxfmrwkb" /d "0"4⤵
- Windows security bypass
PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD527051275caf38adcf7677e7a955adfea
SHA1cd2e048cec404185cdaeec25eb8f4a1879a4bfd0
SHA256c415b005c35c6e337240e2e8fd6cbead3cc4d5d21be5b793175b75aae4b93536
SHA512128d5f42d02711b84e3c5dee045495cf89c6cdec9a68644110fdb7556b60fc61d5c56f17c1c5956f0dc61bb34c444348c04c739bdc04ac9079829b2f0d1a74ce