455710aa03798bf33dd1977531330e0071c046a1eba5937ab922ce1d624b4164

Analysis

max time kernel
93s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b16ac920a4b4de3bcd0cf2bf4b92c0d_JaffaCakes118.dll
Size

41KB
MD5

3b16ac920a4b4de3bcd0cf2bf4b92c0d
SHA1

2a30c0a2d449a5e375f706ba3a3b2ac7bb52b554
SHA256

455710aa03798bf33dd1977531330e0071c046a1eba5937ab922ce1d624b4164
SHA512

2d3b7f8a6390bbd9afd410cf176c929b30f3b74aa55775ff8eb9212396dd46c270cbc6dd6d3dfdda84f0e7065f76b0521f0458d54d0a650f4d8c7907b2ed90bc
SSDEEP

768:Y9jE6HqC82Nh5GbMFCjZdlhX2ef4pPsU+bC90Lh:YjHqC82r5GbMy3+NsUeC90d

Score

1^/10

Malware Config

Signatures

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\VersionIndependentProgID\ = "Guffins.UrlAlertButton"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton.1\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3b16ac920a4b4de3bcd0cf2bf4b92c0d_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton\CurVer\ = "Guffins.UrlAlertButton.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton\CLSID\ = "{224469fc-d32a-423e-90c3-0f69ef5724b8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\ProgID\ = "Guffins.UrlAlertButton.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton.1\CLSID\ = "{224469fc-d32a-423e-90c3-0f69ef5724b8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{224469fc-d32a-423e-90c3-0f69ef5724b8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Guffins.UrlAlertButton.1	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4860	4776	regsvr32.exe	83
PID 4776 wrote to memory of 4860	4776	regsvr32.exe	83
PID 4776 wrote to memory of 4860	4776	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b16ac920a4b4de3bcd0cf2bf4b92c0d_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b16ac920a4b4de3bcd0cf2bf4b92c0d_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:4860

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads