Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 07:01

General

  • Target

    03db1cba8255915a78c896972b9cdd92_JaffaCakes118.dll

  • Size

    708KB

  • MD5

    03db1cba8255915a78c896972b9cdd92

  • SHA1

    2521af9111741b817746d203d920f2b38380ccdc

  • SHA256

    0ad58a3f884f9c4d6f303973b5c134a4d32320f2e0faf1714d71f2a01974f237

  • SHA512

    3bc418655e7815777489ab232a7fda46bfd675661894691764df909523d652578d5314f15cdc4c8d58f708e3f77c31bb68be919fd819a923b618776ec1e4811f

  • SSDEEP

    6144:ru7DF9KUvX20i3gu/dbjMM2JwmHCtZJZObUD68wpPfeO1TnsCKZ4HMK2:r0ZvO0inF3MMmA/eUD68wBhK4R

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 28 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\03db1cba8255915a78c896972b9cdd92_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\03db1cba8255915a78c896972b9cdd92_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:4808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads