f634bd997cf987386a2f31d125ad129f457ae83bbb204ca7f5c0f7d9a76a1476

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:18

Target

650423a4b91037e8602bc76fa04958dc_JaffaCakes118.dll
Size

48KB
MD5

650423a4b91037e8602bc76fa04958dc
SHA1

5305d53288f641e01c3e3cb69f1bf46420186048
SHA256

f634bd997cf987386a2f31d125ad129f457ae83bbb204ca7f5c0f7d9a76a1476
SHA512

d0ce0a37835dbfcad0bc9c07ebb15309caea81fffecd858a50d699a5f9597d6b07c1a7bcf8d586989a4c160904988a8975e5c7b14723dd7c7622d727e64becce
SSDEEP

768:fh4ynEjws73acVjR4IfcsiMwiKClOZwZREG3Th1NrZukE1B32Q8UKfTRdHA:ZE8KrVEsiM4ClzEG3TRlJQ8fz

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Ä)"”ŸL]	regsvr32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ç*!åÌN2\ = "ÁE1RvËÊ<¥\x03(`:ÖœOFcm‹\x156\t"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\È¶	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\È¶\ = "©\x15\"e\x1eÒ€\\fa\|ƒe"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ç*!åÌN2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\È¶\®5X6ÊŠ<¿6v Ç˜C}n“Ps#–À/©#i6ÇªSFbz‰D = "¿\x0f6v Ç˜C\x01}n“Ps#\x7f–À\x11/©\x03#i6ÇªSFbz‰\x03D"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\È¶\ = "‰\x11?x)Í’\vNpkÖTj.z¡"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\°<WôÝ_\`ƒ=}ÍŠZFg=Áp‹?a?ÂBTsL»)Få§[_WK¼4F4À¦uz[K¬ Gê¼iT{]¨7G ñÓ	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\°<WôÝ_	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\°<WôÝ_\`ƒ=}ÍŠZFg=Áp‹?a?ÂBTsL»)Få§[_WK¼4F4À¦uz[K¬ Gê¼iT{]¨7G ñÓ\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\650423a4b91037e8602bc76fa04958dc_JaffaCakes118.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30
PID 1328 wrote to memory of 2288	1328	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\650423a4b91037e8602bc76fa04958dc_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\650423a4b91037e8602bc76fa04958dc_JaffaCakes118.dll
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  PID:2288