Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 07:47
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4ccfcdfc4108b745621238ecd6220ab0.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_4ccfcdfc4108b745621238ecd6220ab0.dll
-
Size
296KB
-
MD5
4ccfcdfc4108b745621238ecd6220ab0
-
SHA1
9f152a499aee8d7ee2dd5c41340f1f018ba1e913
-
SHA256
bce43d43ca65452b5f34f4566d8eb72997ccef45278b588c69f4461445e762d8
-
SHA512
59a9bfb51361137e01ce718f6180308606fa586c46aa88eb771969f831d7b1494c5889f2807ee9a6245cbdcc2f96a55ed0e68d5be55a8f695756aac51dc1159a
-
SSDEEP
3072:JV5J7ftwoflUgXeenxV6FUhRlugpJ+oUZt8IVkZqTLqCIGsIhZORE4FFKv6bIvf0:/7fapZ4OefiIIVXLqCFZOREu6/f0
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2424 regsvr32mgr.exe -
Loads dropped DLL 1 IoCs
pid Process 2424 regsvr32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral2/memory/2424-6-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3620 2424 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F9-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F7-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EE-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A09-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A08-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A01-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F9-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EC-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89EC-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0C-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A06-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A0E-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupMainWindow3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A0A-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupProgress" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A09-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A11-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A06-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupGUIObject" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A07-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A01-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EF-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EE-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupOpType" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A11-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A10-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A07-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupUserInterface" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0A-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89ED-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupOpSequence" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EA-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89FB-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A09-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A08-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F9-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EC-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupFeatureLog" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A0E-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F9-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F0-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89ED-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A12-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupWindowBillBoards" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A12-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0D-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0D-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89ED-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0A-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89EE-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupOpType" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89EE-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F7-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A0B-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A09-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A11-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A10-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A01-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0C-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F7-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F0-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F8-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89EE-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A08-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0A-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F0-5C36-11D5-ABAF-00B0D02332EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89EA-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F8-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F8-5C36-11D5-ABAF-00B0D02332EB}\TypeLib\ = "{777C8A14-5C36-11D5-ABAF-00B0D02332EB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C8A0C-5C36-11D5-ABAF-00B0D02332EB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C8A01-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{777C89F7-5C36-11D5-ABAF-00B0D02332EB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{777C89F0-5C36-11D5-ABAF-00B0D02332EB}\ = "ISetupFeatureLogs" regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4720 wrote to memory of 4036 4720 regsvr32.exe 82 PID 4720 wrote to memory of 4036 4720 regsvr32.exe 82 PID 4720 wrote to memory of 4036 4720 regsvr32.exe 82 PID 4036 wrote to memory of 2424 4036 regsvr32.exe 83 PID 4036 wrote to memory of 2424 4036 regsvr32.exe 83 PID 4036 wrote to memory of 2424 4036 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ccfcdfc4108b745621238ecd6220ab0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ccfcdfc4108b745621238ecd6220ab0.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 5244⤵
- Program crash
PID:3620
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2424 -ip 24241⤵PID:5052
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTRResponse134.71.91.104.in-addr.arpaIN PTRa104-91-71-134deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
134.71.91.104.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
106KB
MD5fe36fb1073e6f8fa14d7250501a29aaf
SHA16c7e01278362797dabcff3e666b68227cb9af10f
SHA256f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
SHA5128584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f