f084cd890a1d491887da0638591e79ab30bc7092a5eb061f0aabb19fea7b86e6

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 12:52

Target

49dc70cf80ebb3624fe7158490d7dd6b_JaffaCakes118.dll
Size

1.3MB
MD5

49dc70cf80ebb3624fe7158490d7dd6b
SHA1

f9ed89fedd9fcdfd344a0d0386b3577f9066eb0b
SHA256

f084cd890a1d491887da0638591e79ab30bc7092a5eb061f0aabb19fea7b86e6
SHA512

6a3faba4cd8070b0adf14aae0af64ad0bad85ba1c46df1323b07f22b75f447177d9c80952b36285b064228d78d264a4a640e4a0a75b02999420959875f694e5a
SSDEEP

24576:IKF5Bbi0UrqpGdropf/k68Jizb9Iv9E5jfaS9YQ8S5/J+mUlTL++6PYIsVLEULh2:Io5fUrTdrak6nb9Iv9OagYQ8YUlTdYY2

Score

1^/10

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5BF5884-6A37-4CEE-AD6B-673E0D314B4D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5BF5884-6A37-4CEE-AD6B-673E0D314B4D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\49dc70cf80ebb3624fe7158490d7dd6b_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5BF5884-6A37-4CEE-AD6B-673E0D314B4D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A5BF5884-6A37-4CEE-AD6B-673E0D314B4D}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3732	3020	regsvr32.exe	83
PID 3020 wrote to memory of 3732	3020	regsvr32.exe	83
PID 3020 wrote to memory of 3732	3020	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49dc70cf80ebb3624fe7158490d7dd6b_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\49dc70cf80ebb3624fe7158490d7dd6b_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:3732

memory/3732-8-0x0000000010052000-0x0000000010053000-memory.dmp

Filesize
4KB

Download
memory/3732-9-0x0000000010000000-0x0000000010139000-memory.dmp

Filesize
1.2MB

Download
memory/3732-10-0x0000000010000000-0x0000000010139000-memory.dmp

Filesize
1.2MB

Download