fab0dab84a9551ae3d2589e2a8da63b686268912cfefe769cc707dc53f0f6974

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36a59b00571d011fb0e724886c4fdf8e_JaffaCakes118.dll
Size

328KB
MD5

36a59b00571d011fb0e724886c4fdf8e
SHA1

640d47dfa7f5489b461f5f3e7cde3b2c3784d555
SHA256

fab0dab84a9551ae3d2589e2a8da63b686268912cfefe769cc707dc53f0f6974
SHA512

56fb74bd8e7b4e32aef9a3a38c351426619cd45b9bcb76440534751cbac9c304dd55ab5fa82dc8e007aff160f2e8ca6ce513d621207a3c07ff1c0bd7bd8c18c4
SSDEEP

6144:suhU1Eo6sWzKzkwLLU5ZDGd91sTVZjrmSdVbsZxvsMwf:KWWzk0LU5ZDGd9WTVtqS7qxvWf

Score

1^/10

Malware Config

Signatures

Modifies registry class 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.FwOpenPort\ = "HNetCfg.FwOpenPort"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d851f103-8c90-4321-aff0-58ba5bd421c2}\AppID = "{ce166e40-1e72-45b9-94c9-3b2050e8f180}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.NATUPnP.1\ = "NATUPnP Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.FwAuthorizedApplication\ = "HNetCfg.FwAuthorizedApplication"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\ = "IAlgController"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\ProxyStubClsid32\ = "{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\ = "{58FBCF7C-E7A9-467C-80B3-FC65E8FCCA08}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.NATUPnP\CurVer\ = "HNetCfg.NATUPnP.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ = "INetFwMgrPrivate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.HNetShare\CurVer\ = "HNetCfg.HNetShare.1"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\AccessPermission = 010014803400000050000000000000001400000002002000010000000000180003000000010200000000000520000000200200000105000000000005150000005951b81766725d2564633b0b7fa928000105000000000005150000005951b81766725d2564633b0b7fa92800	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\ProxyStubClsid32\ = "{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d851f103-8c90-4321-aff0-58ba5bd421c2}\ = "SharedAccess Notification Sink"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\ = "SharedAccess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\LocalService = "SharedAccess"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\NumMethods\ = "12"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1C565858-F302-471E-B409-F180AA4ABEC6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ = "INetFwMgrPrivate"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\ProxyStubClsid32\ = "{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\NumMethods\ = "10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\ = "ISharedAccessUpdate"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\ = "INat"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.NATUPnP\ = "NATUPnP Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d851f103-8c90-4321-aff0-58ba5bd421c2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.HNetShare.1\ = "HNetShare Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.HNetShare\ = "HNetShare Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1C565858-F302-471E-B409-F180AA4ABEC6}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1C565858-F302-471E-B409-F180AA4ABEC6}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\ = "{58FBCF7C-E7A9-467C-80B3-FC65E8FCCA08}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.FwMgr\ = "HNetCfg.FwMgr"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\LaunchPermission = 01000480340000005000000000000000140000000200200001000000000018000900000001020000000000052000000020020000010500000000000515000000a05f841f5e2e6b49ce120303f4010000010500000000000515000000a05f841f5e2e6b49ce120303f4010000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2464	752	regsvr32.exe	83
PID 752 wrote to memory of 2464	752	regsvr32.exe	83
PID 752 wrote to memory of 2464	752	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\36a59b00571d011fb0e724886c4fdf8e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\36a59b00571d011fb0e724886c4fdf8e_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-0-0x0000000060FD0000-0x0000000061026000-memory.dmp

Filesize
344KB

Download
memory/2464-1-0x0000000060FD0000-0x0000000061026000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads