83ffbb780520d303486a33d2648629f2a2dd7a09d10fa24caa7ebb2161732bd6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8415dd95ae7d974bc0f770d8ef275cb_JaffaCakes118.dll
Size

139KB
MD5

e8415dd95ae7d974bc0f770d8ef275cb
SHA1

d54bd217046ffadef3d78e29b27d9050de7e2031
SHA256

83ffbb780520d303486a33d2648629f2a2dd7a09d10fa24caa7ebb2161732bd6
SHA512

44b2e637c4b9d7d27622caf7e83da7c2a872e2806ba0066522be13054697b8123ec0a99e85780c566203bf0817b620154933526666bccaf81a77df1f1788b6e7
SSDEEP

3072:nCfI5yKzhnh7g0Rv96Y8XOLuU2yZKricsrgwZDze:CQ5rzTgoSXhUnZKrarRQ

Score

1^/10

Malware Config

Signatures

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MPAgent.DLL\AppID = "{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent.1\CLSID\ = "{B3E19860-0CD5-4991-A066-4FCA2704DE59}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e8415dd95ae7d974bc0f770d8ef275cb_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e8415dd95ae7d974bc0f770d8ef275cb_JaffaCakes118.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\ = "IAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\ = "CAgent Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\TypeLib\ = "{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent.1\ = "CAgent Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent\CurVer\ = "MPAgent.Agent.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\VersionIndependentProgID\ = "MPAgent.Agent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\ = "IAgent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\ = "MPAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MPAgent.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent\ = "CAgent Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\ProgID\ = "MPAgent.Agent.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\TypeLib\ = "{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent\CLSID\ = "{B3E19860-0CD5-4991-A066-4FCA2704DE59}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\AppID = "{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\TypeLib\ = "{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A395C6C-E42E-4777-B8EF-FDDEB705F3FB}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPAgent.Agent	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\ = "MPAgent 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28
PID 2300 wrote to memory of 2100	2300	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e8415dd95ae7d974bc0f770d8ef275cb_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e8415dd95ae7d974bc0f770d8ef275cb_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2100

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads