Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 14:39

General

  • Target

    63929f064f1ffa5c32d6f7dcb4332b1a_JaffaCakes118.dll

  • Size

    634KB

  • MD5

    63929f064f1ffa5c32d6f7dcb4332b1a

  • SHA1

    e27229fc431e9233109db12e57bcfccdd0258c11

  • SHA256

    8f68a06dd804a6228395f1c24069b7937c1ece38ae9663ab9d9294c87b9aa6cb

  • SHA512

    a58d5f88340601b47aeb863422c7b18367b35c509f197a212ecd87b5f1881ba28d8974af97dae7b15d91a2e632a4a2826794d57091d83f17e41a5f2090729c35

  • SSDEEP

    12288:+M0t9FNcxDMmfrLAF8rZIRf2MmsXaUTydh+/fO79s:2tjNcXnVInvaeOh2

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 11 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\63929f064f1ffa5c32d6f7dcb4332b1a_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\63929f064f1ffa5c32d6f7dcb4332b1a_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:4932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4932-0-0x0000000000B40000-0x0000000000BE4000-memory.dmp

    Filesize

    656KB