98777a8f4b4c276b0ffe989f5f67917e4c7dab8e1ed7dba183c3fb3b89e81cc9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 11:06

Target

222531f46aee127217d8ddc0bbdcb86d_JaffaCakes118.dll
Size

52KB
MD5

222531f46aee127217d8ddc0bbdcb86d
SHA1

1204f230ed73ae3526b9ee2a202ace514f895730
SHA256

98777a8f4b4c276b0ffe989f5f67917e4c7dab8e1ed7dba183c3fb3b89e81cc9
SHA512

85e07e8d8508dc1a309e6d84e2bd8b4ffb850f1836298e9aae7967c9a08ecf9a36216d3e065052430cd095aaca1fff153a0c2c293482997d073842a41a043d96
SSDEEP

768:jxijji8KfS3wVFDCfs5E0L3XDZnnDtByvwbZxVmBa2X8ZKgFxJV5Mk8A:9OHPAVFCfs5Zn9LKw5mQ2XhGR5I

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\0nÃtƒôúú	regsvr32.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DCÞ ¦rTçØ¡ïKË²ÏMuyè1Ñqkà<žDúóŽÃsà™ôeXxñ§a5ÈÜŸéeà„âwzAÔ j4ãê»Ú\|ý„â	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DCÞ ¦rTçØ¡ïKË²ÏMuyè1Ñqkà<žDúóŽÃsà™ôeXxñ§a5ÈÜŸéeà„âwzAÔ j4ãê»Ú\|ý„â\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\222531f46aee127217d8ddc0bbdcb86d_JaffaCakes118.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3mÀw€cEö•	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3mÀw€cEö•\ = "5:î\x0f×MC„Q\|÷=›P\x15÷ážâCÜ¹»"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\<bÏx0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\<bÏx0\ZJÔ—L„Kpé+Aû¦€á[™ü‘g?2]\|ü4—A#ëáŸõAÊË = "Kpé+\u0081A\x11û¦€á[™ü‘g\x16?2\u0081]\|ü4—A#ëáŸõAÊË"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\<bÏx0\ = "]jý8¿T\täÁœóK¬"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\<bÏx0\ = "}nà%ˆK\x1b³é\u008dä\x1e\u009dåœb!"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1908	2648	regsvr32.exe	82
PID 2648 wrote to memory of 1908	2648	regsvr32.exe	82
PID 2648 wrote to memory of 1908	2648	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\222531f46aee127217d8ddc0bbdcb86d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\222531f46aee127217d8ddc0bbdcb86d_JaffaCakes118.dll
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  PID:1908