Analysis
-
max time kernel
137s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 01:57
Static task
static1
Behavioral task
behavioral1
Sample
3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll
Resource
win7-20241010-en
General
-
Target
3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll
-
Size
708KB
-
MD5
3d2eb53616b824bd6c7633ba3b9e8dfa
-
SHA1
9c2cffec0459bf488d31c520503b849d601ff67d
-
SHA256
ab632f1bb9aac5d829ff542bcc95956ad53b85fbb30f3bf36b4e566861d37f61
-
SHA512
6cbfd118ad72fa3bfdbc562dea8b9c1a227f4c409308f65cf1ff25b285697ac2dcd91b1715f8dc48cb5bae8b592cbd13b87fb1c44654c9c4221829f7a7978151
-
SSDEEP
12288:ggbAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+loTN0:gaDis0dFA24/MFSptIJKnx+NE23a3+lN
Malware Config
Extracted
qakbot
402.363
obama106
1632905607
37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Bjlzqi = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Rwqzmwwii = "0" reg.exe -
Loads dropped DLL 1 IoCs
pid Process 1836 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\58c199c5 = 7924e84ea15f6e44ee549ed66268cfe032639b95b5efeae5e6585145bfff4e7480c22208568d405e87f38e5f2d0f058bf0b3ea6f1d721e27a3564e34f4066561613c9ac8e44fdd84795ba2fa39e2a174987f7105edc62867140d8f90381bf3b77260f382aadff63a6391c04917abf0 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\9d75b12a = 00729db2667aa29dda92d10ed68b9ae96722f5b20704b223759b2c257a3a0b0a13d2d3e8f0b60841496b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\a8ea6164 = d950cc1667464c95de133f34a82884ff8f33f8e599aaead7edad2df3958a1baf0b1ae6471b7e24c64d3a853e6972bcd38e40ca3cb9fef3 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\d7a30e92 = 2d12d93445637f05361554bc6cb008da2c272bf92f7dfa10ffd620829602596846fb06257965885b5802c76f2220908cc944f9df6f3e160fa911469fe36d4a31104f959cb6e62a64c77a134a2102c427347dd50e1e0be65284f88a8a98999a7ed051d48779abaa explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\d7a30e92 = 2d12ce3445634a755ddf8daff0cd16c5c712fb9ae2b55a4ec6cf8a156dab85b712ffcadc5e6016f52881ea6ffcfafb49077776b313a2bc74d66a251d0e9034118db30aa12ff2ec7be975f16502a5fd31932e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\e23cdedc = df7bfc0e9431dbd730408c60462db9d759b2c88bd297a400c9c5f8ed5661ecaff1065b8d6aac29296490451cd769480e6ee070801d7bb90cbd9adf913005f1477d716f9c050f5ae0cff265b2d596bab6fe1d9db13bb4039e4098468682df1ad27f5679ad8678237fa605b9cdaf0eba48ff9a4bb17f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\e07dfea0 = 36b4f4e50a05e611adc118abd4ec41d8ba83d5d6fec1313f82d201e39c30bf578becf0198924478ffab4505331875333f85c1840e5148854696fd14450e0ecc98b37e0b2 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\25c9d64f = ff4d7a3bd50a48266b3fb37a13b004fe36727c34239d3434308a87 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Omzbifeyxr\5a80b9b9 = 751f7ea2da7946283275fb34ef7793749a25cfaee0fc950229a5e662c09686f06550046b83eb4ef735d14f9f5c2fa6fed1b796387002f41c32aafa36c4cfdedb5a4401b5b7a85463d3afbf8977c08fa8f7a31a4f65c77a10 explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1228 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3660 rundll32.exe 3660 rundll32.exe 1836 regsvr32.exe 1836 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3660 rundll32.exe 1836 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4392 wrote to memory of 3660 4392 rundll32.exe 83 PID 4392 wrote to memory of 3660 4392 rundll32.exe 83 PID 4392 wrote to memory of 3660 4392 rundll32.exe 83 PID 3660 wrote to memory of 720 3660 rundll32.exe 87 PID 3660 wrote to memory of 720 3660 rundll32.exe 87 PID 3660 wrote to memory of 720 3660 rundll32.exe 87 PID 3660 wrote to memory of 720 3660 rundll32.exe 87 PID 3660 wrote to memory of 720 3660 rundll32.exe 87 PID 720 wrote to memory of 1228 720 explorer.exe 88 PID 720 wrote to memory of 1228 720 explorer.exe 88 PID 720 wrote to memory of 1228 720 explorer.exe 88 PID 3292 wrote to memory of 1836 3292 regsvr32.exe 97 PID 3292 wrote to memory of 1836 3292 regsvr32.exe 97 PID 3292 wrote to memory of 1836 3292 regsvr32.exe 97 PID 1836 wrote to memory of 1848 1836 regsvr32.exe 98 PID 1836 wrote to memory of 1848 1836 regsvr32.exe 98 PID 1836 wrote to memory of 1848 1836 regsvr32.exe 98 PID 1836 wrote to memory of 1848 1836 regsvr32.exe 98 PID 1836 wrote to memory of 1848 1836 regsvr32.exe 98 PID 1848 wrote to memory of 1236 1848 explorer.exe 99 PID 1848 wrote to memory of 1236 1848 explorer.exe 99 PID 1848 wrote to memory of 2948 1848 explorer.exe 101 PID 1848 wrote to memory of 2948 1848 explorer.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pvqjhsvuuz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll\"" /SC ONCE /Z /ST 01:59 /ET 02:114⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1228
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\3d2eb53616b824bd6c7633ba3b9e8dfa_JaffaCakes118.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bjlzqi" /d "0"4⤵
- Windows security bypass
PID:1236
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Rwqzmwwii" /d "0"4⤵
- Windows security bypass
PID:2948
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
708KB
MD53d2eb53616b824bd6c7633ba3b9e8dfa
SHA19c2cffec0459bf488d31c520503b849d601ff67d
SHA256ab632f1bb9aac5d829ff542bcc95956ad53b85fbb30f3bf36b4e566861d37f61
SHA5126cbfd118ad72fa3bfdbc562dea8b9c1a227f4c409308f65cf1ff25b285697ac2dcd91b1715f8dc48cb5bae8b592cbd13b87fb1c44654c9c4221829f7a7978151