Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 07:44

General

  • Target

    04205643c7ef8b8cbcb1f8d4d83301d1_JaffaCakes118.dll

  • Size

    304KB

  • MD5

    04205643c7ef8b8cbcb1f8d4d83301d1

  • SHA1

    a640abf452dc1f647afa93fa5d005af9e6a0ac67

  • SHA256

    303c52ec41e05a71f1d50de5fe5ee8b7f64eb9a9e9a3b23eb9e0bfd5da5e2fd1

  • SHA512

    a1b3cc107a63709eb2ff97a03d55e109e19934fee20f650f29d9d33f9ca515bcbd9d828542e20d0f8bcf39266f96a5a27c9005ef8834b944cb240954c7ffec7a

  • SSDEEP

    3072:Myn1W1+QD1rHq+WHj5IDDqi6SP5WtiktlcFXkzjFjy1FN3gqWwOcFXkzjFjy1FNQ:B8hHq+dPqiFh1kDcFkRYFN8cFkRYFN

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04205643c7ef8b8cbcb1f8d4d83301d1_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\04205643c7ef8b8cbcb1f8d4d83301d1_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads