Analysis

  • max time kernel
    93s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-04-2024 15:08

General

  • Target

    f1594abdc390ac24693b17e22c1ad433_JaffaCakes118.dll

  • Size

    651KB

  • MD5

    f1594abdc390ac24693b17e22c1ad433

  • SHA1

    aae037b5673d5785b7abdb609f087cff4db64307

  • SHA256

    86722dd18841f9ddf3537c42af0d69c4a990f4db6f643374595e98d678f4f7c3

  • SHA512

    4320974e75f36c73a24786472c993c10b1e89fd443510d5a0608b893783a5785e65efc9a2181e2d9b94726e75ed1fb95fd4971570f4bd2db72fa960d03fdb62d

  • SSDEEP

    12288:w1OlLvcoLSgz+O1O1cV1nd3XMPf3M+TfJ8q6xGJOpqG0HtBNUZzvN:w1mLvcoFzVO1aGdTfT0Gkph4U9N

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1594abdc390ac24693b17e22c1ad433_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f1594abdc390ac24693b17e22c1ad433_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/944-0-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/944-2-0x00000000024E0000-0x000000000253A000-memory.dmp

    Filesize

    360KB

  • memory/944-1-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/944-3-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

  • memory/944-4-0x0000000003550000-0x0000000003551000-memory.dmp

    Filesize

    4KB

  • memory/944-5-0x0000000003540000-0x0000000003542000-memory.dmp

    Filesize

    8KB

  • memory/944-6-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

    Filesize

    4KB

  • memory/944-7-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

    Filesize

    4KB

  • memory/944-8-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

    Filesize

    4KB

  • memory/944-9-0x0000000003540000-0x0000000003541000-memory.dmp

    Filesize

    4KB

  • memory/944-10-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB