0f4f3217150d2272bb70919ea611193bddb7d27061d068c0f1a309e2c8cd728b

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 09:26

Target

388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
Size

43KB
MD5

388fa83010a65f83a7a86aa7aa390d89
SHA1

26d8ecf5b6120d75493f483ced858d94d8c5e810
SHA256

0f4f3217150d2272bb70919ea611193bddb7d27061d068c0f1a309e2c8cd728b
SHA512

56f7c38f6f67d1d607d21d02b82030a570ec5a3f2bf8aec6e0e87b07463db414cd28c6911e6d394f4f59a691a3d53c7024d0f2120f75ab3f64a5a507a97c1cd6
SSDEEP

768:UyG4FRhxdtdDqSMD5GN1TucQn2SLcn116Av/8UcLq+35mTbJsE5C86QMMGopW:UyGwFdtdDqSM4NscO1Q1NvUUcLhubJsY

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4072-0-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4072	4372	regsvr32.exe	83
PID 4372 wrote to memory of 4072	4372	regsvr32.exe	83
PID 4372 wrote to memory of 4072	4372	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:4072

memory/4072-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download