57d91aded10fba73bdf6f028bee72aa4a83893dbc9f6bbc9e01b66987b451d5b

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Size

80KB
MD5

2bdd7687d084239c9e456f63bd323270
SHA1

e3a12fea4b34540d9ed96cb8a10fb8e7b8130c38
SHA256

57d91aded10fba73bdf6f028bee72aa4a83893dbc9f6bbc9e01b66987b451d5b
SHA512

1dbc60bb60abfcbdbf475dfe8f4ee7cf69db81347cd35fe6b3bdf14917649186e38c357636419803145525f1e1872de69b3df72be5b158e23c0551f41cf01d7b
SSDEEP

1536:AxuTxeyOCuzlV60s9r75K+egu+EE8rYiHuz:XpBEgu+do/

Score

1^/10

Malware Config

Signatures

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ = "Application"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\ = "Auskunftssystem - QSReport Preview 4.0"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QSDRPrv.Application\Clsid\ = "{1E9BFEE3-825F-4564-A1BC-16583FD1F501}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\0	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\TypeLib	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QSDRPrv.Application\ = "QSDRPrv.Application"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\FLAGS	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\Implemented Categories	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ = "_Application"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ProxyStubClsid32	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ = "_Application"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\TypeLib	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\FLAGS\ = "0"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\0\win32	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\TypeLib\Version = "1.0"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\ProgID\ = "QSDRPrv.Application"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\LocalServer32	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\TypeLib\Version = "1.0"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ProxyStubClsid32	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\Programmable	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\TypeLib\ = "{9316ABCF-0862-4E71-81A6-A06AB88F8081}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\VERSION	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QSDRPrv.Application\Clsid	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\TypeLib\ = "{9316ABCF-0862-4E71-81A6-A06AB88F8081}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\ = "QSDRPrv.Application"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ProxyStubClsid	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\TypeLib	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}\TypeLib\ = "{9316ABCF-0862-4E71-81A6-A06AB88F8081}"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\ProgID	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E9BFEE3-825F-4564-A1BC-16583FD1F501}\VERSION\ = "1.0"	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QSDRPrv.Application	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9316ABCF-0862-4E71-81A6-A06AB88F8081}\1.0\HELPDIR	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F77F25A-49F3-425C-AEED-50121CD3F021}	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bdd7687d084239c9e456f63bd323270_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4192,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
1⤵
PID:4208

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads