d259e2abaeb6e3bae9d0cc1ad96bf77ac64baea7aab979cba0fc26e95618e5a1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Size

551KB
MD5

3fd9db2ba7f3b68f8ad7c1752d3bee91
SHA1

e725afdf26af8da0a487e60d5f6ec8061d176771
SHA256

d259e2abaeb6e3bae9d0cc1ad96bf77ac64baea7aab979cba0fc26e95618e5a1
SHA512

08751539f2b3db09714c7a39adb5e6d2a3be5cb328c13c7ae40b011ad011f9921bb8e092db4c79060777b29563e92d3ee54d893cde773958613ee03f48058c5f
SSDEEP

12288:bTR6XsdyerXSvbJDz8IwmMvMFpKIMOxCy5X3d4pM9SaYGenDl:b4Cy8XSvlvimM0bPh5HyicaRenZ

Score

1^/10

Malware Config

Signatures

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\ = "Oveja Adeziwhiq Winiw class"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\ProgID	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\win32\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\win32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado28.tlb"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\VersionIndependentProgID\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\VersionIndependentProgID\ = "SAPI.SpNotifyTranslator"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\TypeLib	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\InprocServer32\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\InprocServer32\ = "%SystemRoot%\\SysWow64\\Speech\\Common\\sapi.dll"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\win64	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\FLAGS	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\ProgID\ = "SAPI.SpNotifyTranslator.1"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\win64\ = "C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\TypeLib\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\TypeLib\ = "{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\Version\ = "5.4"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\InprocServer32	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\FLAGS\ = "0"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\Version	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\VersionIndependentProgID	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\win64\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\FLAGS\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\Version\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\ = "Microsoft ActiveX Data Objects 2.8 Library"	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8C5B075-A22C-ABDF-B8DF-62D97E0E9E5C}\2.8\0\win32	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CEC7499-F89E-433A-FF98-71A24788B1C1}\ProgID\	3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fd9db2ba7f3b68f8ad7c1752d3bee91_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4456-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4456-1-0x0000000000BE0000-0x0000000000C32000-memory.dmp

Filesize
328KB

Download
memory/4456-62-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-61-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-60-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-59-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-58-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/4456-57-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4456-56-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4456-55-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/4456-54-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-53-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-52-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-51-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-50-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-49-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-48-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-47-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-46-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-45-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-44-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-43-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-42-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-41-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-40-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4456-3-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/4456-39-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4456-38-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/4456-37-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4456-63-0x00000000035B0000-0x00000000035B3000-memory.dmp

Filesize
12KB

Download
memory/4456-36-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4456-35-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/4456-34-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/4456-33-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4456-32-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4456-31-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-30-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-29-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-28-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-27-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-26-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-25-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-24-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-23-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-22-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-21-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-20-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-19-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-18-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-17-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-16-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-15-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-14-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-13-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-12-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-11-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4456-10-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/4456-9-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4456-8-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/4456-7-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/4456-6-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/4456-5-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/4456-4-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/4456-2-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/4456-65-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4456-66-0x0000000000BE0000-0x0000000000C32000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads