5f47791bcb8ab473edbdc66fcae1eabab13d091ba83be1fb3653de30f6f159e9

General

Target
0a57e50ddba3e56233bfe04853f70164_JaffaCakes118.dll
Size 404KB
Sample240621-jst7vasbjd
SHA256 5f47791bcb8ab473edbdc66fcae1eabab13d091ba83be1fb3653de30f6f159e9
MD5 0a57e50ddba3e56233bfe04853f70164
SHA1 156d0e1e723b07c42bbbd9e3c056a6de3c6f5daa
SHA512 e242459180fbffe25037b1cb594dda2531bef07afb025762b80503b8843703bc7c8eab7eb84fad1cf26bf5917f4a1739533219c8d57c22ec2f8ead13cce9ad45
SSDEEP 6144:mPUEfBxW0mCx0/ml8F1lP6D1bUJV6RhxNQBDOi5uHStL6XZW85:mXpoCx0/ml8FIkIRqwHStLEIY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2424	regsvr32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2424	WerFault.exe	84

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\ = "Haali Video Renderer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a57e50ddba3e56233bfe04853f70164_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8B4A31-408B-4929-86A4-A9FA9F01BA43}\ = "Haali Video Renderer Properties"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8B4A31-408B-4929-86A4-A9FA9F01BA43}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8B4A31-408B-4929-86A4-A9FA9F01BA43}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a57e50ddba3e56233bfe04853f70164_JaffaCakes118.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A36C253D-CEE4-4BCA-9CC2-E03CF6BBB054}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A36C253D-CEE4-4BCA-9CC2-E03CF6BBB054}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a57e50ddba3e56233bfe04853f70164_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A36C253D-CEE4-4BCA-9CC2-E03CF6BBB054}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\FilterData = 02000000000020000100000000000000307069330000000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b717eeb36e44f52ce119f530020af0ba770	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8B4A31-408B-4929-86A4-A9FA9F01BA43}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E8B4A31-408B-4929-86A4-A9FA9F01BA43}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A36C253D-CEE4-4BCA-9CC2-E03CF6BBB054}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A36C253D-CEE4-4BCA-9CC2-E03CF6BBB054}\ = "Haali Video Renderer Image Properties"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\FriendlyName = "Haali Video Renderer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{760A8F35-97E7-479D-AAF5-DA9EFF95D751}\CLSID = "{760A8F35-97E7-479D-AAF5-DA9EFF95D751}"	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4756	4492	regsvr32.exe	83
PID 4492 wrote to memory of 4756	4492	regsvr32.exe	83
PID 4492 wrote to memory of 4756	4492	regsvr32.exe	83
PID 4756 wrote to memory of 2424	4756	regsvr32.exe	84
PID 4756 wrote to memory of 2424	4756	regsvr32.exe	84
PID 4756 wrote to memory of 2424	4756	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a57e50ddba3e56233bfe04853f70164_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0a57e50ddba3e56233bfe04853f70164_JaffaCakes118.dll
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\regsvr32mgr.exe
    C:\Windows\SysWOW64\regsvr32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:2424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 420
      4⤵
      Program crash
      PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2424 -ip 2424
1⤵
PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

regsvr32mgr.exe

Path C:\Windows\SysWOW64\regsvr32mgr.exe
Size 160KB
SHA256 a9c5a28460510e5a620bb2683361b899928730b34534e5774c0221081c15d4ce
MD5 51a7b8e6dde65bdc6db16675e8e4efb2
SHA1 04be1eef924fe57a3a2f9a93dd1458283366242f
SHA512 ee7fcc988ae337548e04595f574f1c68d3f2e80020d4e7be6a9dea967ad18f3262c8eced03e6ee914d248e4a51e58190ad9a761f7ad97dda7aee8531511306e2
SSDEEP 3072:aBno0flsXMeR/aBvKsdjcC463tvwm3od0teaY/JPfMhq7T:alo0fGa1lcC/U02/JPfMhq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4756-0-0x0000000010000000-0x000000001006A000-memory.dmp

Download

Analysis

Sharing