Overview
overview
10Static
static
106b9d5ed62b...18.exe
windows7-x64
76b9d5ed62b...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3AutoUpdaterUI.exe
windows7-x64
3AutoUpdaterUI.exe
windows10-2004-x64
3Autoupdate...te.dll
windows7-x64
5Autoupdate...te.dll
windows10-2004-x64
5Autoupdate...er.exe
windows7-x64
3Autoupdate...er.exe
windows10-2004-x64
3Bind/AVCheck.dll
windows7-x64
3Bind/AVCheck.dll
windows10-2004-x64
3Bind/GetAV.exe
windows7-x64
6Bind/GetAV.exe
windows10-2004-x64
6Bind/HTTPD...UI.exe
windows7-x64
3Bind/HTTPD...UI.exe
windows10-2004-x64
3DevCfg.dll
windows7-x64
5DevCfg.dll
windows10-2004-x64
5DockHelp.dll
windows7-x64
3DockHelp.dll
windows10-2004-x64
3DockHelpex.dll
windows7-x64
3DockHelpex.dll
windows10-2004-x64
3DriveTheLife.exe
windows7-x64
10DriveTheLife.exe
windows10-2004-x64
10hdaudbus.sys
windows7-x64
1hdaudbus.sys
windows10-2004-x64
1Drivers/wn...UI.dll
windows7-x64
3Drivers/wn...UI.dll
windows10-2004-x64
3Drivers/wn...SP.dll
windows7-x64
3Drivers/wn...SP.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2024 18:33
Behavioral task
behavioral1
Sample
6b9d5ed62bf77ebcf1d9a4ce12eeef6f_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
6b9d5ed62bf77ebcf1d9a4ce12eeef6f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
AutoUpdaterUI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
AutoUpdaterUI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Autoupdater/CheckUpdate.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Autoupdater/CheckUpdate.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Autoupdater/DTLUpdater.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
Autoupdater/DTLUpdater.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Bind/AVCheck.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
Bind/AVCheck.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Bind/GetAV.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Bind/GetAV.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Bind/HTTPDownloadUI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Bind/HTTPDownloadUI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
DevCfg.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
DevCfg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
DockHelp.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
DockHelp.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
DockHelpex.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
DockHelpex.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
DriveTheLife.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
DriveTheLife.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
hdaudbus.sys
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral28
Sample
hdaudbus.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Drivers/wnd7audio/SysFxUI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Drivers/wnd7audio/SysFxUI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Drivers/wnd7audio/WMALFXGFXDSP.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Drivers/wnd7audio/WMALFXGFXDSP.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Drivers/wnd7audio/WMALFXGFXDSP.dll
-
Size
1.2MB
-
MD5
7434fe8c29e19a952367d9c0f96d7c0c
-
SHA1
aec687c54427c051b92c7fb51e65ad31a03b8f3e
-
SHA256
0a49274a2205df5ca751c2d4c5966f4d5c9482c73af39bce98d55487a21fde63
-
SHA512
2fbb0f671e3ac44bed3dd2bd9deaef662165faa5a6435740c6e89bdd2a3c504e6f33c68b98b8512e54e6910f65d669c88148b3ddc52510001c3fdee3b9387e4e
-
SSDEEP
24576:xDRswqbynSUxyn2zvvmvKze+wnm8vJ8vP/4H4wfgbIy:xt9qbySUxy2z1zeZjvmvP/4H4wfgbIy
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\AUDIOENGINE\AUDIOPROCESSINGOBJECTS\{62DC1A93-AE24-464C-A43E-452F824C4250} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MinOutputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{637c490d-eee3-4c0a-973f-371958802da2}\ = "WM GFX APO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{637c490d-eee3-4c0a-973f-371958802da2}\InprocServer32 regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MinorVersion = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62dc1a93-ae24-464c-a43e-452f824c4250} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62dc1a93-ae24-464c-a43e-452f824c4250}\InprocServer32 regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\Flags = "13" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MaxInputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{637c490d-eee3-4c0a-973f-371958802da2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Drivers\\wnd7audio\\WMALFXGFXDSP.dll" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MajorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\Flags = "13" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MinOutputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62dc1a93-ae24-464c-a43e-452f824c4250}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MinInputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{637c490d-eee3-4c0a-973f-371958802da2}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\Copyright = "Copyright Microsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62dc1a93-ae24-464c-a43e-452f824c4250}\ = "WM LFX APO" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MajorVersion = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{637c490d-eee3-4c0a-973f-371958802da2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\Copyright = "Copyright Microsoft" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MaxOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MinInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MaxOutputConnections = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\AUDIOENGINE\AUDIOPROCESSINGOBJECTS\{637C490D-EEE3-4C0A-973F-371958802DA2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\FriendlyName = "WM audio GFX APO" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MaxInstances = "4294967295" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MinorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\MaxInstances = "4294967295" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\NumAPOInterfaces = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62dc1a93-ae24-464c-a43e-452f824c4250}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Drivers\\wnd7audio\\WMALFXGFXDSP.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{62DC1A93-AE24-464C-A43E-452F824C4250}\FriendlyName = "WM audio LFX APO" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{637C490D-EEE3-4C0A-973F-371958802DA2}\MaxInputConnections = "1" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1172 wrote to memory of 4692 1172 regsvr32.exe 85 PID 1172 wrote to memory of 4692 1172 regsvr32.exe 85 PID 1172 wrote to memory of 4692 1172 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Drivers\wnd7audio\WMALFXGFXDSP.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Drivers\wnd7audio\WMALFXGFXDSP.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4692
-