45fc16ebfe2590099a7b754d7971168ba8db1dfea626e387c8597377a954f9f1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72f65e261dc6455b0e185c58f5146ea9_JaffaCakes118.dll
Size

64KB
MD5

72f65e261dc6455b0e185c58f5146ea9
SHA1

db2d978b58f5da23d0932f45aa090ba9ee9952a6
SHA256

45fc16ebfe2590099a7b754d7971168ba8db1dfea626e387c8597377a954f9f1
SHA512

09b8684858eff1ca4d1b3d5d234895b918b83185b47a7110f7a9044c78cea7b2414212c9554eb67385f15e7b9d1a8fbe74e196c7c15802073e8513c06edd7bdf
SSDEEP

1536:aofhm5JniQe+3ubU7cA7IHnhya3G6TbVcSjMTWrUNa:aJeiDiGQBj2WrUNa

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Ž©ß´PÖiŠ	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\g£´¡¨ÔÅKÑ“Wè…ó]RŠ•ÛÞˆ\‹Š—âNØ`þ¿oÃ®+ÛpS“¥£Ìkî`ð£~Ã¤6ëa}·¥¬©ÿYåLß¹~Ô³X\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\72f65e261dc6455b0e185c58f5146ea9_JaffaCakes118.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\‚¥Ó–\yª¾®™êE¦hƒ€çWÙ5ðGºËNw¨ã~œ–Ÿ™çeÉrï‰]éü = "h\u0090ƒ€\u008fçWÙ5ð\u009dGºËNw¨\x17\x19ã~œ–Ÿ™çeÉrï‰]éü"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\g£´¡¨ÔÅKÑ“Wè…ó]RŠ•ÛÞˆ\‹Š—âNØ`þ¿oÃ®+ÛpS“¥£Ìkî`ð£~Ã¤6ëa}·¥¬©ÿYåLß¹~Ô³X	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\g£´¡¨ÔÅKÑ“Wè…ó]RŠ•ÛÞˆ	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ªÜŽÅÔ	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ªÜŽÅÔ\ = "\x16Ú„¤Ùë\x05¦rœ\u009d–•öSÕrîž_ÿŽd"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\‚¥Ó–	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\‚¥Ó–\ = "~Š—“±òOÆRì\u008fW\u008f"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\‚¥Ó–\ = "^ŽŠŽ†í]‘zý˜\x02¾ÒCrŸ"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1500	220	regsvr32.exe	84
PID 220 wrote to memory of 1500	220	regsvr32.exe	84
PID 220 wrote to memory of 1500	220	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72f65e261dc6455b0e185c58f5146ea9_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72f65e261dc6455b0e185c58f5146ea9_JaffaCakes118.dll
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads