224ac151cdfd9f16058f7599f6c3b11d81a4ab5c081b0d8cd8de8d28835cc344

Analysis

max time kernel
142s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Size

351KB
MD5

2521afdeb143b6a15de93c8404913ae8
SHA1

bd59e3ca31dc7f08aab66cb867ce487788c25f92
SHA256

224ac151cdfd9f16058f7599f6c3b11d81a4ab5c081b0d8cd8de8d28835cc344
SHA512

8544f068b3ce7e153f6c14dfe975377e2f2c6a04e093a978ced8e5b580eb8ee5d652d411dd0371e6d1eab44982f7e0b0fa5c7f9b9f768c08d0127e743cc28644
SSDEEP

6144:XC9M1ZHPN53iQe5WydwYGXPyWMM9amUlF9MjLkG6n+aCyIK3ccnMxj0Uv3iZ:oiZvTiMymY4NMMVG83CW1K3DnsYU6Z

Score

1^/10

Malware Config

Signatures

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\ = "MSAAText 1.0 Type Library"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\0\win32\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\VersionIndependentProgID\ = "SAPI.SpStreamFormatConverter"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\ProgID	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\0\win32	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\msaatext.dll"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\TypeLib\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\Version	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\Version\ = "5.4"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\ = "Degon Obediniw Object"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\InprocServer32\ = "%SystemRoot%\\SysWow64\\Speech\\Common\\sapi.dll"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\TypeLib	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\VersionIndependentProgID	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\InprocServer32	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\0\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\FLAGS	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\VersionIndependentProgID\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\ProgID\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\FLAGS\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\FLAGS\ = "0"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\TypeLib\ = "{5C61D997-4207-9765-8A11-25396773795D}"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\InprocServer32\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\ProgID\ = "SAPI.SpStreamFormatConverter.1"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5C61D997-4207-9765-8A11-25396773795D}\1.0\0	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2098CEA4-80C7-4435-BFAF-B0DA523E2EE7}\Version\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4976	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-0-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4976-40-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-39-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-38-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-37-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-36-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-35-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-34-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-33-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-32-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-31-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-30-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-29-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-28-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-27-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-26-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-25-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-24-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-23-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-22-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-21-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-20-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-19-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-18-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-17-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-16-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-15-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-14-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-13-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-12-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-11-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-10-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-9-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-8-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-7-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-6-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-5-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-4-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-3-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-1-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-2-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4976-42-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/4976-41-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4976-43-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4976-46-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-45-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-44-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-53-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-52-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-51-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-50-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-49-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-48-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-47-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-57-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-56-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4976-55-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads