c6329764795d38d5edc92d26baa767dd34b0ea1c81047f47a7cc57cec542716a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 15:52

Target

467f321344229c08230fae0621a112fa_JaffaCakes118.dll
Size

83KB
MD5

467f321344229c08230fae0621a112fa
SHA1

ba65a3a0ecdc30d71ce151b6a55b750581f5bb81
SHA256

c6329764795d38d5edc92d26baa767dd34b0ea1c81047f47a7cc57cec542716a
SHA512

f6a47c1e40ea73f096d1ea9af2d4b6615c61c18db1032887824dcad13cbf0ca9e2a63443ea8b124aa515af1131d128a9ab67ebbf20756f7c4ddd306063b47d49
SSDEEP

1536:DxEzrd8vE4/qP9eEBFQLhTs+4Rf7ZqmsPSUgAzK4RDH9O91A9dh09:DxEzrdN8qP9f6u5Rf74Y0ztDH9O91Chs

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4556-1-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4556-7-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4556-10-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Nbmteobt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Nbmteobt\	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\Nbmteobt\CLSID	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ProgID	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Key created	\Registry\Machine\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Nbmteobt\CLSID\ = "{00000000-0000-0000-0000-000000000000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ProgID\ = "Nbmteobt"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4556	2900	regsvr32.exe	83
PID 2900 wrote to memory of 4556	2900	regsvr32.exe	83
PID 2900 wrote to memory of 4556	2900	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\467f321344229c08230fae0621a112fa_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\467f321344229c08230fae0621a112fa_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:4556

memory/4556-0-0x0000000000540000-0x0000000000577000-memory.dmp

Filesize
220KB

Download
memory/4556-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-2-0x0000000002B70000-0x0000000002BA7000-memory.dmp

Filesize
220KB

Download
memory/4556-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-9-0x0000000000540000-0x0000000000577000-memory.dmp

Filesize
220KB

Download
memory/4556-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download