Analysis

  • max time kernel
    128s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 11:02

General

  • Target

    95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll

  • Size

    7KB

  • MD5

    95d3e8a28f585caea44a696bbe80c065

  • SHA1

    defe19c8aa857f1ba71c4c3b4ca414c041d96fe1

  • SHA256

    28cf4ce194946329da547b7a8b01ad66643e6b0183a7ef95d45d2d701c1eedb2

  • SHA512

    5ae92924bbd55a0fb414dcee8f68c6c3a7b7f139e78b707e579bd66a98e18eb64b4728a3355e5316e2d0ef08b1a470a7b0bec500add9b09dcea6ee85f4755583

  • SSDEEP

    192:id9piB3B5PPICyjBCco5jLudg1dqycMc:O9pCB5PPNGB6XuGDqH

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\95d3e8a28f585caea44a696bbe80c065_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2808-0-0x0000000010000000-0x0000000010009000-memory.dmp

    Filesize

    36KB