8e92a0d234117d0ab8b9fba1696aeab36d565e42b888ef70368e1b60e3690cf3

General

Target

65a684451694a0882ae5b6df7141fa3a_JaffaCakes118.dll
Size

10KB
MD5

65a684451694a0882ae5b6df7141fa3a
SHA1

34d89650ca8ad32bad6616cf9d23cf3a4c50600f
SHA256

8e92a0d234117d0ab8b9fba1696aeab36d565e42b888ef70368e1b60e3690cf3
SHA512

e378f521606f2a9d5b43d8b2f2c925c5e7dbd03dc6bc0265177c532e36852c72308b364adcb12ad37f0228866b125c6a0700ce030f64ec66aef9549bd2f74f2a
SSDEEP

192:WNzaehF6zUxegF/zimuHV4SsspiPlMjsemvAjAYEWYpofWxZ1qofkW:yzaMv1JSjiPUOYBYpcWxZ1xfkW

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AFC3636-DB01-4052-80C3-03BBCB8D3C69}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88306BB2-E71F-478C-86A2-79DA200A0F11}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF24EFA4-AADE-4B6B-898B-EAA6A20887C7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0818A8EF-9BA9-40D8-A6F9-E22833CC771E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAEBEEF3-8523-47ED-A2B9-05CECCE2A1AE}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B69D7F5-9D94-4648-91CA-79939BA263BF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07E5C822-F00C-47A1-8FCE-B244DA56FD06}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07E5C822-F00C-47A1-8FCE-B244DA56FD06}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33B87426-5C06-49F4-84BD-F486B1B4A21D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AFC3636-DB01-4052-80C3-03BBCB8D3C69}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54D1F9E3-7FD3-421A-AF9C-53C2D8EE5BCF}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAEBEEF3-8523-47ED-A2B9-05CECCE2A1AE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0316560B-5DB4-4ED9-BBB5-213436DDC0D9}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E882C452-CF37-482A-BBFF-E6EE614E8023}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10C5E575-7984-4E81-A56B-431F5F92AE42}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{574A73AF-BAA8-448A-A764-F457D146D32F}\ = "IVdsDiskPath"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FCEE2D3-6D90-4F91-80E2-A5C7CAACA9D8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0EE1A790-5D2E-4ABB-8C99-C481E8BE2138}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF24EFA4-AADE-4B6B-898B-EAA6A20887C7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88306BB2-E71F-478C-86A2-79DA200A0F11}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B69D7F5-9D94-4648-91CA-79939BA263BF}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E0393303-90D4-4A97-AB71-E9B671EE2729}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D188E97D-85AA-4D33-ABC6-26299A10FFC1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E6F6B40-977C-4069-BDDD-AC710059F8C0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5D23B6D-5A55-4492-9889-397A3C2D2DBC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0EE1A790-5D2E-4ABB-8C99-C481E8BE2138}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2772ADB2-4A0A-41DB-A213-C4686615206E}\ProxyStubClsid32\ = "{E0393303-90D4-4A97-AB71-E9B671EE2729}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3540A9C7-E60F-4111-A840-8BBA6C2C83D8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF24EFA4-AADE-4B6B-898B-EAA6A20887C7}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D99BDAAE-B13A-4178-9FDB-E27F16B4603E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAEBEEF3-8523-47ED-A2B9-05CECCE2A1AE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33B87426-5C06-49F4-84BD-F486B1B4A21D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11F3CD41-B7E8-48FF-9472-9DFF018AA292}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{574A73AF-BAA8-448A-A764-F457D146D32F}\ProxyStubClsid32\ = "{E0393303-90D4-4A97-AB71-E9B671EE2729}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2772ADB2-4A0A-41DB-A213-C4686615206E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9AA58360-CE33-4F92-B658-ED24B14425B8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9AA58360-CE33-4F92-B658-ED24B14425B8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{118610B7-8D94-4030-B5B8-500889788E4E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54D1F9E3-7FD3-421A-AF9C-53C2D8EE5BCF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DAA0135-E1D1-40F1-AAA5-3CC1E53221C3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D188E97D-85AA-4D33-ABC6-26299A10FFC1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2772ADB2-4A0A-41DB-A213-C4686615206E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2772ADB2-4A0A-41DB-A213-C4686615206E}\NumMethods\ = "5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE2D5DED-6236-4169-931D-B9778CE03DC6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9AA58360-CE33-4F92-B658-ED24B14425B8}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3540A9C7-E60F-4111-A840-8BBA6C2C83D8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0316560B-5DB4-4ED9-BBB5-213436DDC0D9}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DAA0135-E1D1-40F1-AAA5-3CC1E53221C3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0818A8EF-9BA9-40D8-A6F9-E22833CC771E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5D23B6D-5A55-4492-9889-397A3C2D2DBC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CB53D96E-DFFB-474A-A078-790D1E2BC082}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{574A73AF-BAA8-448A-A764-F457D146D32F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FCEE2D3-6D90-4F91-80E2-A5C7CAACA9D8}\NumMethods	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11F3CD41-B7E8-48FF-9472-9DFF018AA292}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10C5E575-7984-4E81-A56B-431F5F92AE42}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CB53D96E-DFFB-474A-A078-790D1E2BC082}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{118610B7-8D94-4030-B5B8-500889788E4E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0393303-90D4-4A97-AB71-E9B671EE2729}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0393303-90D4-4A97-AB71-E9B671EE2729}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AFC3636-DB01-4052-80C3-03BBCB8D3C69}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5D23B6D-5A55-4492-9889-397A3C2D2DBC}\NumMethods	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 448 wrote to memory of 2032	448	regsvr32.exe	regsvr32.exe
PID 448 wrote to memory of 2032	448	regsvr32.exe	regsvr32.exe
PID 448 wrote to memory of 2032	448	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65a684451694a0882ae5b6df7141fa3a_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\65a684451694a0882ae5b6df7141fa3a_JaffaCakes118.dll
2⤵
- Modifies registry class
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3608,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
1⤵
PID:3212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x000000005A6F0000-0x000000005A6FB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads