1f7e7f0d4480f595f3dccb4170762a1b1d544c6464bfa46c8ebce762e2b0651a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe
Size 228KB
Sample240603-npy4vada4w
SHA256 1f7e7f0d4480f595f3dccb4170762a1b1d544c6464bfa46c8ebce762e2b0651a
MD5 91a2988c4394daf219c3e84205981b6f
SHA1 996ecfe4899ddcd6aad556d757d45e273e90bce5
SHA512 d0676e0db7d029666fc476b14c59264d3c2c557ea555d70d0ddcf1e34bb00fedf34956c6df0b65ee0405e26bde31579620fa2cb85c46f4f2728c6dd5701c0a2a
SSDEEP 3072:SkEf8Jc47AI+fu7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrXLMRR4vKvblBQjS2Z:rNcGlBNkVsuaRaU6mHGbMRR4vQ+W2oS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023447-18.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4596	regsvr32.exe
2612	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023447-18.dat	upx
behavioral2/memory/2612-20-0x0000000011000000-0x0000000011032000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sys.dat	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe
File opened for modification	C:\Windows\win.ini	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Es58.P2P\Clsid\ = "{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\TypeLib\ = "{52DAF8C9-8861-47A8-BC17-077666A2342A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Es58.P2P\ = "Es58.P2P"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Es58.P2P\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~DFA2758.tmp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~DFA2758.tmp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\ProgID\ = "Es58.P2P"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ = "_P2P"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib\ = "{52DAF8C9-8861-47A8-BC17-077666A2342A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4596	1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe	81
PID 1612 wrote to memory of 4596	1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe	81
PID 1612 wrote to memory of 4596	1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe	81
PID 1612 wrote to memory of 2612	1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe	82
PID 1612 wrote to memory of 2612	1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe	82
PID 1612 wrote to memory of 2612	1612	91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91a2988c4394daf219c3e84205981b6f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\mswinsck.ocx"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4596
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\~DFA2758.tmp"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

~DFA2758.tmp

Path C:\Users\Admin\AppData\Local\Temp\~DFA2758.tmp
Size 48KB
SHA256 1c208796cd09557fe2d0a375f30a2feb49b45af8661798ab0046883cd68d54fd
MD5 73e40295ab0e0c740b114b9251042b87
SHA1 e057bc7de709e34e9ae666fdb713708f038af819
SHA512 883171d6108e1d2a62437a2a37b84b9d33b22737eaead2355bdeccf028e0fbb5491e45087f7c397f58adf4837e43fd3a410c47d78426bf90669d71025e4a6b98
SSDEEP 1536:bLnMRrF4vvYxrjbKhHS6uBIVWcHykOKIV+nouy8:bLMRR4vKvblBQjS2out
MD5 SHA1 SHA512 SSDEEP

Submit Download

mswinsck.ocx

Path C:\Windows\SysWOW64\mswinsck.ocx
Size 105KB
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
MD5 SHA1 SHA512 SSDEEP

Submit Download

sys.dat

Path C:\Windows\sys.dat
Size 6KB
SHA256 e84dc2e75ff9c42a616fa520bfee7521dcaccb53b9aaaab5d395849d1603cfb2
MD5 2a2d1ebec44e2b6c778bddd332e5ab76
SHA1 0dd61faa6f44b5fdd62327859ce089dad564e48e
SHA512 4574487f1af29e5e5b085d9d01fd728419c3e6246872026c2f3ec781e6cea0dbd56cff5375fc49bdcf6f5e2eaa564d366d823ca314725322e9d855e288cb32ef
SSDEEP 192:q+OPSFC0pi72iDedcs/bdhHVCL8Cxt7y3:qW7pO2iDez/bHVOpfg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2612-20-0x0000000011000000-0x0000000011032000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads