8608120d12354a42a26046c5f692f76cfb8d4df2894a7edddbd1cea7e20ecdc0

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c0dde8688872dfbe57069e3fd6dd545_JaffaCakes118.dll
Size

328KB
MD5

5c0dde8688872dfbe57069e3fd6dd545
SHA1

4baaa06d19ba2e1eb424251e5df4133e5af725a3
SHA256

8608120d12354a42a26046c5f692f76cfb8d4df2894a7edddbd1cea7e20ecdc0
SHA512

21bc22e3d78a34ceae00f01a1f0b19a42c8d9f5777cd51f281c85866f055b036d3f9e1382aef8a5d549b7dc89e3f42691aeeb5d6f3f0e0f82f6ab8a870e7aa77
SSDEEP

6144:leWU1EoYJ60O2hGTj/I0kkhIBtInj181Fyt7CbadrjswA8:n80Nh2XkkhIBtInj1Gyt7ldJA

Score

1^/10

Malware Config

Signatures

Modifies registry class 59 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\NumMethods\ = "5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\LocalService = "SharedAccess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\ = "{58FBCF7C-E7A9-467C-80B3-FC65E8FCCA08}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.FwAuthorizedApplication\ = "HNetCfg.FwAuthorizedApplication"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\AccessPermission = 010014803400000050000000000000001400000002002000010000000000180003000000010200000000000520000000200200000105000000000005150000005951b81766725d2564633b0b7fa928000105000000000005150000005951b81766725d2564633b0b7fa92800	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\LaunchPermission = 01000480340000005000000000000000140000000200200001000000000018000900000001020000000000052000000020020000010500000000000515000000a05f841f5e2e6b49ce120303f4010000010500000000000515000000a05f841f5e2e6b49ce120303f4010000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\ = "INat"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1C565858-F302-471E-B409-F180AA4ABEC6}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.NATUPnP\CurVer\ = "HNetCfg.NATUPnP.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.HNetShare.1\ = "HNetShare Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\NumMethods\ = "12"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ = "INetFwMgrPrivate"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.HNetShare\CurVer\ = "HNetCfg.HNetShare.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ = "INetFwMgrPrivate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\ = "{58FBCF7C-E7A9-467C-80B3-FC65E8FCCA08}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.NATUPnP\ = "NATUPnP Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.NATUPnP.1\ = "NATUPnP Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.FwOpenPort\ = "HNetCfg.FwOpenPort"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\NumMethods\ = "10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ce166e40-1e72-45b9-94c9-3b2050e8f180}\ = "SharedAccess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\ = "IAlgController"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\ProxyStubClsid32\ = "{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1C565858-F302-471E-B409-F180AA4ABEC6}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.HNetShare\ = "HNetShare Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d851f103-8c90-4321-aff0-58ba5bd421c2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d851f103-8c90-4321-aff0-58ba5bd421c2}\AppID = "{ce166e40-1e72-45b9-94c9-3b2050e8f180}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HNetCfg.FwMgr\ = "HNetCfg.FwMgr"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\ProxyStubClsid32\ = "{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C037FD2-2B42-4A0F-B8A2-611D10E03117}\ = "ISharedAccessUpdate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d851f103-8c90-4321-aff0-58ba5bd421c2}\ = "SharedAccess Notification Sink"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1C565858-F302-471E-B409-F180AA4ABEC6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FBE7FE9-4AD1-4D70-BB77-66963016FD09}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B71BFBF1-2AF2-4820-810C-4F8EFF838E60}\ProxyStubClsid32\ = "{FDD384CC-78C6-4E6D-8694-1DACBEE57F96}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2440	2720	regsvr32.exe	84
PID 2720 wrote to memory of 2440	2720	regsvr32.exe	84
PID 2720 wrote to memory of 2440	2720	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c0dde8688872dfbe57069e3fd6dd545_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5c0dde8688872dfbe57069e3fd6dd545_JaffaCakes118.dll
  2⤵
  - Modifies registry class
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000060FD0000-0x0000000061026000-memory.dmp

Filesize
344KB

Download
memory/2440-1-0x0000000060FD0000-0x0000000061026000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads