55bcd6cdb00b83a021b2f483de5e429e111e13d608bd35d315c60d5cb1bd8fe6

General

Target

65a7b9b69bfe6a3135415ee127736a6d_JaffaCakes118.dll
Size

739KB
MD5

65a7b9b69bfe6a3135415ee127736a6d
SHA1

cac21990d4222bef5d935b788716af710e9ac7dd
SHA256

55bcd6cdb00b83a021b2f483de5e429e111e13d608bd35d315c60d5cb1bd8fe6
SHA512

1c70d59d1a4ffe9c2ad15edbaadc9015af3db2acacd0e4bae5f10e822994953a66924da523a041b534e3c7deadffef268efd7988c202f4b04a999ea1df3df2e1
SSDEEP

12288:7t7C0Q/P9cdEXF3Z4mxx9cOTpwRZCOTPJFKN3WDzDxn4ZAQsU:5ut+d0QmXNT2C23CwfJ4ZAPU

Score

1^/10

Malware Config

Signatures

Modifies registry class 27 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\LocalServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\TypeLib\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\0\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\ = "FaxControl 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\Microsoft.SharePoint.exe\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\ProgID\ = "NucleusNativeMessaging.NucleusNativeMessaging.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\Setup\\FXSOCM.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\VersionIndependentProgID\ = "NucleusNativeMessaging.NucleusNativeMessaging"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\0\win64\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{89B7C0D5-3F07-B707-D38F-2C992C5442FE}\1.0\FLAGS\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\ = "Difoxim.Ibaded Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\LocalServer32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\ProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC0CDFB2-7B49-49C7-7399-BE9B50219331}\TypeLib\ = "{89B7C0D5-3F07-B707-D38F-2C992C5442FE}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4928 wrote to memory of 1980	4928	regsvr32.exe	regsvr32.exe
PID 4928 wrote to memory of 1980	4928	regsvr32.exe	regsvr32.exe
PID 4928 wrote to memory of 1980	4928	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65a7b9b69bfe6a3135415ee127736a6d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\65a7b9b69bfe6a3135415ee127736a6d_JaffaCakes118.dll
2⤵
- Modifies registry class
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-7-0x0000000002AE0000-0x0000000002B34000-memory.dmp

Filesize
336KB

Download
memory/1980-8-0x00000000043F0000-0x0000000004407000-memory.dmp

Filesize
92KB

Download
memory/1980-6-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/1980-5-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1980-4-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/1980-3-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1980-2-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/1980-1-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/1980-0-0x0000000011000000-0x00000000111C4000-memory.dmp

Filesize
1.8MB

Download
memory/1980-9-0x0000000002AE0000-0x0000000002B34000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads