55bcd6cdb00b83a021b2f483de5e429e111e13d608bd35d315c60d5cb1bd8fe6

General

Target

65a7b9b69bfe6a3135415ee127736a6d_JaffaCakes118.dll
Size

739KB
MD5

65a7b9b69bfe6a3135415ee127736a6d
SHA1

cac21990d4222bef5d935b788716af710e9ac7dd
SHA256

55bcd6cdb00b83a021b2f483de5e429e111e13d608bd35d315c60d5cb1bd8fe6
SHA512

1c70d59d1a4ffe9c2ad15edbaadc9015af3db2acacd0e4bae5f10e822994953a66924da523a041b534e3c7deadffef268efd7988c202f4b04a999ea1df3df2e1
SSDEEP

12288:7t7C0Q/P9cdEXF3Z4mxx9cOTpwRZCOTPJFKN3WDzDxn4ZAQsU:5ut+d0QmXNT2C23CwfJ4ZAPU

Score

1^/10

Malware Config

Signatures

Modifies registry class 30 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\TypeLib\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\TypeLib\ = "{657835F8-5800-8C15-1BB1-A016588DD587}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\ProgID\ = "Scripting.Signer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\0\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\ = "Groove Forms Private Type Library 1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\163"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\Version\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\ = "Ivahaqoq.Higihnake.Hegewivda class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\FLAGS\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\InprocServer32\ = "C:\\Windows\\SysWOW64\\wshext.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\ProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\0\win32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\InprocServer32\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF1A9DDF-7779-457D-F0B8-4A8A7D26383C}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{657835F8-5800-8C15-1BB1-A016588DD587}\1.0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe
PID 2988 wrote to memory of 2992	2988	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65a7b9b69bfe6a3135415ee127736a6d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\65a7b9b69bfe6a3135415ee127736a6d_JaffaCakes118.dll
2⤵
- Modifies registry class
PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-1-0x0000000000380000-0x00000000003D4000-memory.dmp

Filesize
336KB

Download
memory/2992-0-0x0000000011000000-0x00000000111C4000-memory.dmp

Filesize
1.8MB

Download
memory/2992-2-0x0000000003A30000-0x0000000003A47000-memory.dmp

Filesize
92KB

Download
memory/2992-3-0x0000000000380000-0x00000000003D4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads