bec13e536894d70d7314e7cc1f71336a4fcbd1412f82d2df5848c434fb3277dd

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 08:03

Target

ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll
Size

49KB
MD5

ea9ce6867ce927586a33b41caffba7bd
SHA1

390c2f7b49826051140bdc9a62b3f46a0185dca7
SHA256

bec13e536894d70d7314e7cc1f71336a4fcbd1412f82d2df5848c434fb3277dd
SHA512

8c7bff81212e3b8ea6d2a7051485077527b5c58a0102e6d4afcdb37f23c74c8745e373b49ebdc40b32acfb3736086ff22a644b2c459d6d0659959781bdfa8311
SSDEEP

768:FNGjXkm73tgpx3WmFMjyFDCVkqlUPpNLEP/Xb3AMvZmuPuinbcuyD7U:FojXkmapA5je0qpNY/XTA2m+uinouy8

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EE3612DC-2588-11DD-9B1D-A99356D89593}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28
PID 1800 wrote to memory of 2092	1800	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ea9ce6867ce927586a33b41caffba7bd_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2092

memory/2092-0-0x00000000001B0000-0x00000000001D8000-memory.dmp

Filesize
160KB

Download
memory/2092-1-0x00000000001B0000-0x00000000001D8000-memory.dmp

Filesize
160KB

Download