c6329764795d38d5edc92d26baa767dd34b0ea1c81047f47a7cc57cec542716a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 15:52

Target

467f321344229c08230fae0621a112fa_JaffaCakes118.dll
Size

83KB
MD5

467f321344229c08230fae0621a112fa
SHA1

ba65a3a0ecdc30d71ce151b6a55b750581f5bb81
SHA256

c6329764795d38d5edc92d26baa767dd34b0ea1c81047f47a7cc57cec542716a
SHA512

f6a47c1e40ea73f096d1ea9af2d4b6615c61c18db1032887824dcad13cbf0ca9e2a63443ea8b124aa515af1131d128a9ab67ebbf20756f7c4ddd306063b47d49
SSDEEP

1536:DxEzrd8vE4/qP9eEBFQLhTs+4Rf7ZqmsPSUgAzK4RDH9O91A9dh09:DxEzrdN8qP9f6u5Rf74Y0ztDH9O91Chs

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2176-1-0x00000000002C0000-0x00000000002F3000-memory.dmp	upx
behavioral1/memory/2176-7-0x00000000002C0000-0x00000000002F3000-memory.dmp	upx
behavioral1/memory/2176-11-0x00000000002C0000-0x00000000002F3000-memory.dmp	upx

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Xgnseedr	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xgnseedr\	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Xgnseedr\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ProgID\ = "Xgnseedr"	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xgnseedr\CLSID\ = "{00000000-0000-0000-0000-000000000000}"	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30
PID 2708 wrote to memory of 2176	2708	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\467f321344229c08230fae0621a112fa_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\467f321344229c08230fae0621a112fa_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2176

memory/2176-0-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/2176-1-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/2176-2-0x0000000000340000-0x0000000000377000-memory.dmp

Filesize
220KB

Download
memory/2176-7-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/2176-8-0x00000000024C0000-0x00000000025D0000-memory.dmp

Filesize
1.1MB

Download
memory/2176-11-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/2176-10-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download