Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 16:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll
-
Size
156KB
-
MD5
311e582290499868d8f10ebd7942c4ec
-
SHA1
0035cc2965e005ccf70db91c1eedeba2641d0467
-
SHA256
58f31628d7eb8ec8d55ae7b30282a4a14d2d291d083f4b1296e81537dec29559
-
SHA512
69f0660db1689e68ed0e65c8cee0802ea3d90bfe8e003b9721de8b215da48028fd8db5cd707a55d397dcc9cc07b5e4a7a9260d098d9f78f8f89b9da8e7b11074
-
SSDEEP
3072:UIfi6M+yZ4KBQDw3QBpq3ynj6ARCPBr+MDRpu0gP+rpEhoRxAkY6:UN6M+yHceQBpq86ARCPJnmrmc
Score
1/10
Malware Config
Signatures
-
Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\*\shellex regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\*\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\System Protector regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\System Protector\ = "{107A1D63-2EAA-4694-8ABA-EC209C630D83}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\System Protector\ = "{107A1D63-2EAA-4694-8ABA-EC209C630D83}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\*\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Directory\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Directory\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\System Protector regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\System Protector regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\ = "System Protector Context Menu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}\InprocServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Directory\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\*\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\System Protector\ = "{107A1D63-2EAA-4694-8ABA-EC209C630D83}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Directory\shellex\ regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4996 wrote to memory of 5016 4996 regsvr32.exe 79 PID 4996 wrote to memory of 5016 4996 regsvr32.exe 79 PID 4996 wrote to memory of 5016 4996 regsvr32.exe 79
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\311e582290499868d8f10ebd7942c4ec_JaffaCakes118.dll2⤵
- Modifies registry class
PID:5016
-