Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 15:08

General

  • Target

    f1594abdc390ac24693b17e22c1ad433_JaffaCakes118.dll

  • Size

    651KB

  • MD5

    f1594abdc390ac24693b17e22c1ad433

  • SHA1

    aae037b5673d5785b7abdb609f087cff4db64307

  • SHA256

    86722dd18841f9ddf3537c42af0d69c4a990f4db6f643374595e98d678f4f7c3

  • SHA512

    4320974e75f36c73a24786472c993c10b1e89fd443510d5a0608b893783a5785e65efc9a2181e2d9b94726e75ed1fb95fd4971570f4bd2db72fa960d03fdb62d

  • SSDEEP

    12288:w1OlLvcoLSgz+O1O1cV1nd3XMPf3M+TfJ8q6xGJOpqG0HtBNUZzvN:w1mLvcoFzVO1aGdTfT0Gkph4U9N

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1594abdc390ac24693b17e22c1ad433_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f1594abdc390ac24693b17e22c1ad433_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-0-0x0000000002300000-0x0000000002445000-memory.dmp

    Filesize

    1.3MB

  • memory/1964-1-0x0000000003590000-0x0000000003592000-memory.dmp

    Filesize

    8KB

  • memory/1964-2-0x0000000000370000-0x00000000003CA000-memory.dmp

    Filesize

    360KB