Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 20:46
Behavioral task
behavioral1
Sample
4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
-
Size
168KB
-
MD5
4ef048492244f4133c3d706c7637d410
-
SHA1
4dcb034f48036747c5da9718a69a63e8bc4476fe
-
SHA256
57b240b0d5f67ecea128750855a72ee96e9e4ace6cbde11d1c9808d8b350ad11
-
SHA512
68ba48a61a6d4d686e598e375d014ebf83318d7011566c9c3e5b0c1497a76c29ddcf5edd62081fb89d1928136ca8916e3c37eb3405c43798641baf4c200f1946
-
SSDEEP
3072:lC54Wp/CQb6rfAsbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7rQDjz:leRp/LI9wvP6bQ7yMP+DE827rM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\ = "invoke 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4284 wrote to memory of 3532 4284 regsvr32.exe 86 PID 4284 wrote to memory of 3532 4284 regsvr32.exe 86 PID 4284 wrote to memory of 3532 4284 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3532
-