3baf26624c337f8bd5b60e76641a6addded3d41e0780de797b8b74155598ae43

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e024498696cb9cffdb435ee89fd80e4_JaffaCakes118.dll
Size

92KB
MD5

4e024498696cb9cffdb435ee89fd80e4
SHA1

32b84717928972708b7a2202abf8cd1949b7b9b4
SHA256

3baf26624c337f8bd5b60e76641a6addded3d41e0780de797b8b74155598ae43
SHA512

2f6ccd66ed932de8de9d6f3c5228b77ae0bd9450b763146c8e9bbdd61f667ccb8afc13413d58bb8856b142a250cbf75eabe2c6064a3e72ab2016989bb073839f
SSDEEP

1536:Mpo7Ui94HT1xn/aZYmi01PfuHFSgEuPrXUTFWEl8XAaqA5Rzc22DcJ:gUUi94Hxxn/aZj1Pf2XzXOfl6fqAM2Wu

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1B220B8-56C4-4334-A575-54DBA3251478}\ProgID\ = "TBHO.XTimer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBHO.clsWaitableTimer\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\ = "TBHO.BHOMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\TypeLib\ = "{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\ = "_XTimer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1B220B8-56C4-4334-A575-54DBA3251478}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBHO.XTimer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\ = "clsWaitableTimer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\TypeLib\ = "{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBHO.XTimer\Clsid\ = "{F1B220B8-56C4-4334-A575-54DBA3251478}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\ProgID\ = "TBHO.BHOMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}\ = "_BHOMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e024498696cb9cffdb435ee89fd80e4_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}\ = "BHOMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1B220B8-56C4-4334-A575-54DBA3251478}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBHO.clsWaitableTimer\Clsid\ = "{11C46AED-8107-4263-B99B-3FB95509C932}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}\1.0\ = "TBHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\TypeLib\ = "{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBHO.BHOMain	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1B220B8-56C4-4334-A575-54DBA3251478}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11C46AED-8107-4263-B99B-3FB95509C932}\ = "TBHO.clsWaitableTimer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{95F54FC9-D2DD-4B5C-8363-DA7DF4E31FFA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24994808-213E-4B6F-AB45-48F74BEACEA7}\ = "__XTimer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\ = "_clsWaitableTimer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCD04B3A-7800-49CE-8678-9B34566FDF0E}\TypeLib\ = "{45CE4B12-D8D9-4C81-BD57-6F4616FAB714}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50CEC51-5897-47BE-8215-D0BC1BB178E4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9EE978E6-C05C-46D8-93B8-E6012B92A0E2}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31
PID 3032 wrote to memory of 2648	3032	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4e024498696cb9cffdb435ee89fd80e4_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4e024498696cb9cffdb435ee89fd80e4_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2648

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads