Analysis
-
max time kernel
140s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2024 14:42
Static task
static1
Behavioral task
behavioral1
Sample
220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll
-
Size
708KB
-
MD5
220ec7a64ec692132475ee33b328b125
-
SHA1
b3feb502dfa4e14bf4c2e5bf3268df19259a3332
-
SHA256
9f7e20d79b13e8dec5c8be47c4fd0c1cc110cc9c85b7587377d38f6aaf1aa963
-
SHA512
c4877a1d7dbc945a8ae395bdab38e865ef3d0cfe8abab40b53fa16aad05b31f7d2ecdd38836d0598a3e22ad2dc055b3283355c3417a2d28d43e68f06f00d05b3
-
SSDEEP
12288:8abAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+FoTNm:8QDis0dFA24/MFSptoJKnx+NE23a3+Fj
Malware Config
Extracted
qakbot
402.363
obama106
1632905607
37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Fcyqbnjofob = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Yqbbamjuhi = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe -
Loads dropped DLL 1 IoCs
pid Process 740 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\5fc040a8 = 63301a9319cbc0b8ba782dd0ee explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\d0a2d7ff = 8b27448039494fcd7230235cc8cc8bf6f90def51744536db55241b095a931a0f5831ba3a90eb9a2fa413e530a68dfc402a68db3d17b1984ef490a1b6acb037382c29206efd290dd72df7ca52d69131b4a0138374c672439dee9e299fd4c2c8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\adaa9875 = 7c68efd2acfb23bb5aa7374bd2853d8edf7ba53295a94030e60f45f44174 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\5fc040a8 = 63300d9319cbf54615cb9b75c36e7a0a7eae69312526505783dc60fb82ea207cbcd8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\20892f5e = 191134f40683ccafd1eede52d7f9904f2c2c8c90b2cfffd5c1276d38a2b55c44cfb33fcb3f30c2efe01cc5c5dc99c6b08d8a6540d32c64aead7efa71f45e5b630d3f6002de1824efe6fbb1545ee3886e9a5d5b161cd47e538120b9c4cea9d967 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\6a5f90e6 = 38b83d088bc8aa5e5a917cd0decbd529d3f9a146728a8841fd2c868d862c77fcab8c7b53e120bf1b2a41e874491c442e933623436020d0f4cc2fb5310af6ed3603c4877d8159d535634226932313688df933202dd94da270534c94c6ccad455f51a7732738b44260893c33a6bf1880b5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\681eb09a = 1fcd37c595b682e6c92c2ee96b4983b19a7833e79db6b9e217b9de7420 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\1516ff10 = 8c6ac3bd56bb51c3323396b22c4373d91571234d19f96a690a32f80b74 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Egsmayekaewjoz\d2e3f783 = 562cc4deb61ec1467b43f84cf2381a6b798367ba48 explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 184 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4316 rundll32.exe 4316 rundll32.exe 740 regsvr32.exe 740 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4316 rundll32.exe 740 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4316 4572 rundll32.exe 83 PID 4572 wrote to memory of 4316 4572 rundll32.exe 83 PID 4572 wrote to memory of 4316 4572 rundll32.exe 83 PID 4316 wrote to memory of 2084 4316 rundll32.exe 87 PID 4316 wrote to memory of 2084 4316 rundll32.exe 87 PID 4316 wrote to memory of 2084 4316 rundll32.exe 87 PID 4316 wrote to memory of 2084 4316 rundll32.exe 87 PID 4316 wrote to memory of 2084 4316 rundll32.exe 87 PID 2084 wrote to memory of 184 2084 explorer.exe 88 PID 2084 wrote to memory of 184 2084 explorer.exe 88 PID 2084 wrote to memory of 184 2084 explorer.exe 88 PID 4508 wrote to memory of 740 4508 regsvr32.exe 95 PID 4508 wrote to memory of 740 4508 regsvr32.exe 95 PID 4508 wrote to memory of 740 4508 regsvr32.exe 95 PID 740 wrote to memory of 1480 740 regsvr32.exe 96 PID 740 wrote to memory of 1480 740 regsvr32.exe 96 PID 740 wrote to memory of 1480 740 regsvr32.exe 96 PID 740 wrote to memory of 1480 740 regsvr32.exe 96 PID 740 wrote to memory of 1480 740 regsvr32.exe 96 PID 1480 wrote to memory of 3428 1480 explorer.exe 97 PID 1480 wrote to memory of 3428 1480 explorer.exe 97 PID 1480 wrote to memory of 4076 1480 explorer.exe 99 PID 1480 wrote to memory of 4076 1480 explorer.exe 99
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn eryukunbvg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll\"" /SC ONCE /Z /ST 20:00 /ET 20:124⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:184
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\220ec7a64ec692132475ee33b328b125_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fcyqbnjofob" /d "0"4⤵
- Windows security bypass
PID:3428
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yqbbamjuhi" /d "0"4⤵
- Windows security bypass
PID:4076
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
708KB
MD5220ec7a64ec692132475ee33b328b125
SHA1b3feb502dfa4e14bf4c2e5bf3268df19259a3332
SHA2569f7e20d79b13e8dec5c8be47c4fd0c1cc110cc9c85b7587377d38f6aaf1aa963
SHA512c4877a1d7dbc945a8ae395bdab38e865ef3d0cfe8abab40b53fa16aad05b31f7d2ecdd38836d0598a3e22ad2dc055b3283355c3417a2d28d43e68f06f00d05b3