ad398f1bbff9f02c31839aafc51bb248fa9c268d51a2fb56df70a5440479ccf9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1949f553c7c02b9026c8c82bcc6006d7_JaffaCakes118.dll
Size

206KB
MD5

1949f553c7c02b9026c8c82bcc6006d7
SHA1

fc00aaa8919ab29eabd289e4af09f20ece27dab9
SHA256

ad398f1bbff9f02c31839aafc51bb248fa9c268d51a2fb56df70a5440479ccf9
SHA512

7b12b98ad3873acc4787982ef10a2153cf67a3585f1b05d5eeeffe7cea9af9c72b0d070c74c00f9c7af152ca95fab0e40b76b8633c7e2af500241696cfb45b7a
SSDEEP

3072:G5DUvM5yh9ncoYzGIRkPTDhP6sC4Z1S8kYd9rIAAYqn2AGgpC3jAPWsY:FMIh9cpb0/J6sCw1BHrIAAx2IpE2W

Score

1^/10

Malware Config

Signatures

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object 0.98	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object\CLSID\ = "{29011971-1999-4F54-554D-41494E535545}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\ProgID\ = "PPP over Ethernet Protocol Notify Object 0.98"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object 0.98\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object 0.98\CLSID\ = "{29011971-1999-4F54-554D-41494E535545}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\VersionIndependentProgID\ = "PPP over Ethernet Protocol Notify Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object 0.98\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPP over Ethernet Protocol Notify Object\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29011971-1999-4F54-554D-41494E535545}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1949f553c7c02b9026c8c82bcc6006d7_JaffaCakes118.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1949f553c7c02b9026c8c82bcc6006d7_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1949f553c7c02b9026c8c82bcc6006d7_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2376-2-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2376-1-0x0000000010008000-0x0000000010031000-memory.dmp

Filesize
164KB

Download
memory/2376-6-0x0000000000190000-0x00000000001B5000-memory.dmp

Filesize
148KB

Download
memory/2376-4-0x0000000000190000-0x00000000001B5000-memory.dmp

Filesize
148KB

Download
memory/2376-3-0x0000000000210000-0x0000000000215000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads