28464426110a469bed97ee155e507d7bbaf8da921fed8cfd537e5ad89fb07180

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93b631c42068e6ecb58d9999cab3ff01_JaffaCakes118.dll
Size

16KB
MD5

93b631c42068e6ecb58d9999cab3ff01
SHA1

4f8dd17bf1c5b5a8d77d4218f0b1f8569b3ccaec
SHA256

28464426110a469bed97ee155e507d7bbaf8da921fed8cfd537e5ad89fb07180
SHA512

2720980fba27ba66ff2815fa08cc71afe57d81d4a594a3dc1b5a2fc181af814c14c00d994251f69417ceeefb80e83a5c77e57421aa4148d73bbd04ce8683151c
SSDEEP

384:l7sLRcjB9XX4+o1nnfVH5iIIxlf7IWvtYguZ1HYp0WB:l7KujB9XI+oVnfVH5iPyi+gE1HK

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FDA6D9C7-317C-4421-AE84-15169104AD69}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FDA6D9C7-317C-4421-AE84-15169104AD69}\FriendlyName = "ZhiSoft_NullRender"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FDA6D9C7-317C-4421-AE84-15169104AD69}\CLSID = "{FDA6D9C7-317C-4421-AE84-15169104AD69}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FDA6D9C7-317C-4421-AE84-15169104AD69}\FilterData = 020000000000200001000000000000003070693300000000000000000100000000000000000000003074793300000000380000003800000000000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDA6D9C7-317C-4421-AE84-15169104AD69}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDA6D9C7-317C-4421-AE84-15169104AD69}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDA6D9C7-317C-4421-AE84-15169104AD69}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93b631c42068e6ecb58d9999cab3ff01_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDA6D9C7-317C-4421-AE84-15169104AD69}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDA6D9C7-317C-4421-AE84-15169104AD69}\ = "ZhiSoft_NullRender"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2400	2708	regsvr32.exe	83
PID 2708 wrote to memory of 2400	2708	regsvr32.exe	83
PID 2708 wrote to memory of 2400	2708	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\93b631c42068e6ecb58d9999cab3ff01_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\93b631c42068e6ecb58d9999cab3ff01_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-1-0x000000001000A000-0x000000001000B000-memory.dmp

Filesize
4KB

Download
memory/2400-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads