7f10de72e06cd33afc76263991400bfa3d42f3b3b8c6b9b20bd6457ec65a9155

General

Target

68ef5a4ecab4fe38ace1b7dba86eec71_JaffaCakes118.dll
Size

46KB
MD5

68ef5a4ecab4fe38ace1b7dba86eec71
SHA1

1d23a2957c30be91daa394bed21e4e074912a2ab
SHA256

7f10de72e06cd33afc76263991400bfa3d42f3b3b8c6b9b20bd6457ec65a9155
SHA512

38dd25708ed1b8ba538e5b8f89793232db8e85063e8edd9f398a7918cae1083f3bfa8a486a0f0162ca5081ea286f8ec93c386641ed205ba119d91c9e25cbf1b5
SSDEEP

768:TTvjdUWILzlBx5ypQbTcwH9VwF170WEDK:T7uBzV8wUjlED

Score

1^/10

Malware Config

Signatures

Modifies registry class 37 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CurVer\ = "IAS.DataStoreComServer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\ = " "	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\ = "IIASDataStoreComServer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1\CLSID\ = "{48DA6741-1BF0-4A44-8325-293086C79077}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\TypeLib\ = "{DFDFB4EB-32B7-4B7F-A3D4-F798F75D3A46}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1\ = " "	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CLSID\ = "{48DA6741-1BF0-4A44-8325-293086C79077}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68ef5a4ecab4fe38ace1b7dba86eec71_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83E05BD5-AEC1-4E58-AE50-E819C7296F67}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}\ = "IIASDataStoreComServer2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\VersionIndependentProgID\ = "IAS.DataStoreComServer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C323BE28-E546-4C23-A81B-D6AD8D8FAC7B}\TypeLib\ = "{DFDFB4EB-32B7-4B7F-A3D4-F798F75D3A46}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\ = " "	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IAS.DataStoreComServer\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\ProgID\ = "IAS.DataStoreComServer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48DA6741-1BF0-4A44-8325-293086C79077}\TypeLib\ = "{DFDFB4EB-32B7-4B7F-A3D4-F798F75D3A46}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3064 wrote to memory of 2688	3064	regsvr32.exe	regsvr32.exe
PID 3064 wrote to memory of 2688	3064	regsvr32.exe	regsvr32.exe
PID 3064 wrote to memory of 2688	3064	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\68ef5a4ecab4fe38ace1b7dba86eec71_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\68ef5a4ecab4fe38ace1b7dba86eec71_JaffaCakes118.dll
2⤵
- Modifies registry class
PID:2688

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads