Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 09:27
Behavioral task
behavioral1
Sample
670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll
-
Size
206KB
-
MD5
670302878df8951e71fefde10c42e1d6
-
SHA1
f5f25c637d772f7896a59e76c1d00a6e12ce16e2
-
SHA256
49284cba90a7c60de5f0707ff3fbacf576f18190b28b1cef3f7cdbc5f9748679
-
SHA512
dce55b0b0f06c14500603de34613f3acfe1826025fa1badccc4f79940da89130634e0b115b8fd95fbf002df461199c0b020fb6bf46633cbd3232dbc7c8eaebbd
-
SSDEEP
3072:zvZGGAM3JxMGM4cJSCuHfkQR88/mBw+tbozHxbOM/J8BgpbtoDsQyleex/Df:zvZOM3bncJfuHc83ma+tcRp5R+s1eOT
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2092-0-0x0000000000890000-0x0000000000974000-memory.dmp upx -
Modifies registry class 55 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll,-313" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid\ = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\ = "Media Codec" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID\ = "cndr32a.Video" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation\Enabled = "1" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30 PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30 PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30 PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30 PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30 PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30 PID 1856 wrote to memory of 2092 1856 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\670302878df8951e71fefde10c42e1d6_JaffaCakes118.dll2⤵
- Modifies registry class
PID:2092
-