Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 20:46
Behavioral task
behavioral1
Sample
4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
-
Size
168KB
-
MD5
4ef048492244f4133c3d706c7637d410
-
SHA1
4dcb034f48036747c5da9718a69a63e8bc4476fe
-
SHA256
57b240b0d5f67ecea128750855a72ee96e9e4ace6cbde11d1c9808d8b350ad11
-
SHA512
68ba48a61a6d4d686e598e375d014ebf83318d7011566c9c3e5b0c1497a76c29ddcf5edd62081fb89d1928136ca8916e3c37eb3405c43798641baf4c200f1946
-
SSDEEP
3072:lC54Wp/CQb6rfAsbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7rQDjz:leRp/LI9wvP6bQ7yMP+DE827rM
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\ = "invoke 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31 PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31 PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31 PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31 PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31 PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31 PID 1708 wrote to memory of 2484 1708 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2484
-