Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 11:31

General

  • Target

    01ee4f79e55751d99447a835503da7d3_JaffaCakes118.dll

  • Size

    123KB

  • MD5

    01ee4f79e55751d99447a835503da7d3

  • SHA1

    9bbf6adfa0ac3c0ad1046fe0d3f1be1178ca24c9

  • SHA256

    1a3744c528563018905f72c6f2dc769ee3ea83b568ffd780065e22fdaebafd70

  • SHA512

    0bccd8ec53fb66b6039f469ff849449d06bc03ce6e1401410b73c0e31a2027922d424c86e3ec14bf65da089f25397c5636e71c5f6873a1859986475260411a0e

  • SSDEEP

    3072:SNG0ZeC/azzmWxd/mZQA3li46eqtEGrHQgnG:KtzyKYJmmAweYrc

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 46 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\01ee4f79e55751d99447a835503da7d3_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\01ee4f79e55751d99447a835503da7d3_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:4704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads