Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 20:46
Static task
static1
Behavioral task
behavioral1
Sample
68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll
-
Size
48KB
-
MD5
68de595f2dd57e39fd2a67af4bf8ef56
-
SHA1
24a1249ea4d014289a138ff4994ee6304c150b89
-
SHA256
48f97b5e18f8cf226dd6a69b9369e7743c31ac38f3f6046b46c5354d07796722
-
SHA512
1f20bb066807369f4ed699861d7f979e4f51c8f2bf98acb0c8ba379b4f955f3e25962b5cc683ea0784e8adb65b3be3c554232c8560a2aa868c3f5b44e8dde22e
-
SSDEEP
768:F6lTDJ/wRR1GhxNtWm9DbdBUOGJbM1GGd0PdZXmSOM8:nEhoYDbdBUdl5qaXj
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\TypeLib\Version = "3.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ = "CZipUp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\TypeLib\ = "{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ = "_CZipUp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\TypeLib\ = "{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ = "CZipUp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ = "_CZipUp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\ProgID\ = "ZipUp.CZipUp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\TypeLib\Version = "3.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ = "__CZipUp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\ = "ZipUp.CZipUp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZipUp.CZipUp\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZipUp.CZipUp regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZipUp.CZipUp\Clsid\ = "{78791EA9-CFF2-4416-B269-B0EC01426E6A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\TypeLib\Version = "3.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\TypeLib\ = "{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\TypeLib\Version = "3.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\TypeLib\ = "{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZipUp.CZipUp\ = "ZipUp.CZipUp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\VERSION\ = "3.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1D7C7D-B813-4BBA-938E-639DEE801991}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ = "__CZipUp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78791EA9-CFF2-4416-B269-B0EC01426E6A}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\ = "ZipUp component" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D45481DA-F9E4-430D-A7F6-53B5915833BC}\TypeLib\ = "{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6DE33CA-21A7-464B-A7FD-B7E91A67E7F3}\3.0\FLAGS\ = "0" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3832 wrote to memory of 1276 3832 regsvr32.exe 85 PID 3832 wrote to memory of 1276 3832 regsvr32.exe 85 PID 3832 wrote to memory of 1276 3832 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\68de595f2dd57e39fd2a67af4bf8ef56_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1276
-