Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll
-
Size
52KB
-
MD5
53569596c29b4ae4e271284717a1fca2
-
SHA1
03e414e1906c63d09a335ff23b795fcde94b6082
-
SHA256
b2ced88c56dc7f6fbe8a12b426e2b1ca48c1cfda6ba5cd23cebd598344e21856
-
SHA512
d806f29c03c23c8e96628f9d0b0b6d076b98e82e5e29b783e96388c3f97d5fb9327d1f0a240d1e810fe29e9eb651cd3431f09909a6123b486f864505fbfe7472
-
SSDEEP
768:VcSxxizyNaGVh8c4CRyqygYjuEdKln6D9CrMLJ4ryzWqXGIcuxjjn:HOWNaGVh14CRyqyg6d42PLJw4hf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 33 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MajorVersion = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84585C01-7301-4da2-887E-AE94A936B992} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84585C01-7301-4da2-887E-AE94A936B992}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MinOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MaxInstances = "4294967295" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\NumAPOInterfaces = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\Copyright = "Copyright (c) Andrea Electronics Corporation" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1BB3F995-6989-463d-8FC1-8D0E53EEF936}\ = "AESTARen" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\ = "AEAudioAPODlllib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84585C01-7301-4da2-887E-AE94A936B992}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MinInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MaxOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\Flags = "15" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AESTARen.DLL\AppID = "{1BB3F995-6989-463d-8FC1-8D0E53EEF936}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\FriendlyName = "CAEAudioAPOGFX" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MaxInputConnections = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AESTARen.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84585C01-7301-4da2-887E-AE94A936B992}\ = "AEAudioAPOGFX Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\APOInterface0 = "{1B1A7073-99E8-410D-A7D5-2E454670AFE6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1BB3F995-6989-463d-8FC1-8D0E53EEF936} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{84585C01-7301-4DA2-887E-AE94A936B992}\MinorVersion = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84585C01-7301-4da2-887E-AE94A936B992}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDE58C1F-3AD1-467A-AB9F-A068D2907731} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31 PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31 PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31 PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31 PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31 PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31 PID 1840 wrote to memory of 1776 1840 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\53569596c29b4ae4e271284717a1fca2_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1776
-