d259e2abaeb6e3bae9d0cc1ad96bf77ac64baea7aab979cba0fc26e95618e5a1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Size

551KB
MD5

3fd9db2ba7f3b68f8ad7c1752d3bee91
SHA1

e725afdf26af8da0a487e60d5f6ec8061d176771
SHA256

d259e2abaeb6e3bae9d0cc1ad96bf77ac64baea7aab979cba0fc26e95618e5a1
SHA512

08751539f2b3db09714c7a39adb5e6d2a3be5cb328c13c7ae40b011ad011f9921bb8e092db4c79060777b29563e92d3ee54d893cde773958613ee03f48058c5f
SSDEEP

12288:bTR6XsdyerXSvbJDz8IwmMvMFpKIMOxCy5X3d4pM9SaYGenDl:b4Cy8XSvlvimM0bPh5HyicaRenZ

Score

1^/10

Malware Config

Signatures

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\TypeLib\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Version\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\VersionIndependentProgID	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\MiscStatus	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\MiscStatus\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\ProgID\ = "TDCCtl.TDCCtl.1"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Programmable	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Implemented Categories	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\MiscStatus\ = "0"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\ = "Not Public. Internal interface used by Windows Media Player."	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\FLAGS\ = "0"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\VersionIndependentProgID\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Control	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\ProgID	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\ProgID\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Control\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\0\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\0\win32\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\TypeLib	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\ = "Ajewihxin Oliliji Object"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\InprocServer32\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\0\win32	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\wmpencen.dll"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Version	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\InprocServer32	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\0	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\FLAGS\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\VersionIndependentProgID\ = "TDCCtl.TDCCtl"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Implemented Categories\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\InprocServer32\ = "C:\\Windows\\SysWOW64\\tdc.ocx"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Programmable\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\Version\ = "1.0"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A5DD284-C993-DD94-269D-A7EECCACB68E}\1.0\FLAGS	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708E9385-D967-440C-0894-4490F759C8DD}\TypeLib\ = "{8A5DD284-C993-DD94-269D-A7EECCACB68E}"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2212-1-0x00000000004F0000-0x00000000005E0000-memory.dmp

Filesize
960KB

Download
memory/2212-4-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2212-3-0x0000000000496000-0x0000000000497000-memory.dmp

Filesize
4KB

Download
memory/2212-2-0x00000000004F0000-0x00000000005E0000-memory.dmp

Filesize
960KB

Download
memory/2212-5-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads