Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll
-
Size
156KB
-
MD5
311e582290499868d8f10ebd7942c4ec
-
SHA1
0035cc2965e005ccf70db91c1eedeba2641d0467
-
SHA256
58f31628d7eb8ec8d55ae7b30282a4a14d2d291d083f4b1296e81537dec29559
-
SHA512
69f0660db1689e68ed0e65c8cee0802ea3d90bfe8e003b9721de8b215da48028fd8db5cd707a55d397dcc9cc07b5e4a7a9260d098d9f78f8f89b9da8e7b11074
-
SSDEEP
3072:UIfi6M+yZ4KBQDw3QBpq3ynj6ARCPBr+MDRpu0gP+rpEhoRxAkY6:UN6M+yHceQBpq86ARCPJnmrmc
Score
1/10
Malware Config
Signatures
-
Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\System Protector regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\System Protector\ = "{107A1D63-2EAA-4694-8ABA-EC209C630D83}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\System Protector regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\ = "System Protector Context Menu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\System Protector regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\System Protector\ = "{107A1D63-2EAA-4694-8ABA-EC209C630D83}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\System Protector\ = "{107A1D63-2EAA-4694-8ABA-EC209C630D83}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30 PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30 PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30 PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30 PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30 PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30 PID 2052 wrote to memory of 2892 2052 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll2⤵
- Modifies registry class
PID:2892
-