Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.dll
-
Size
561KB
-
MD5
63259280b89c5cb6baf44f4ed3d16ef0
-
SHA1
1aee29d5c2f41ec07396959d6484b93695c503a3
-
SHA256
a3b18fea0bf5fe1485568d5bc48ddc88308d0f2492d37386c0f2f1ca570f0348
-
SHA512
bb67a5c30597607360d7c4860a2fd23c5ad27e375ad4447a9f3c7bbd9fbd51ce49ebd70274c71f6eefe4c60ee2c55fe36446ef099191d34444cd31efb52142b6
-
SSDEEP
12288:ogUV94y09yxH1az44i2JiU5VVNIUOZH5by2dnsTD0:EVGy0E04wskIZHMEsT
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732} regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}\ = "ic" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.ic regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.ic\ = "ic" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}\ProgID\ = "JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.ic" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.ic\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.ic\Clsid\ = "{CC01FC6C-BC21-5B5B-3F41-667BBD4D1732}" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30 PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30 PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30 PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30 PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30 PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30 PID 2504 wrote to memory of 1212 2504 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63259280b89c5cb6baf44f4ed3d16ef0.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1212
-