Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 16:25

General

  • Target

    JaffaCakes118_5c23de2328cb66ae54f6bd5032e2b3f8.dll

  • Size

    103KB

  • MD5

    5c23de2328cb66ae54f6bd5032e2b3f8

  • SHA1

    98da00099b22acd8a566a3e5f39093990f24e843

  • SHA256

    1f9e659a758f3c817a407021cc8aceaca588ab8716541961894204bf5c620f4f

  • SHA512

    0b9823da2f89183872e6bd005a87c6d374f10ebe1a0338b75588ae16cd4bbab4b5cff23cb67f14f18e73d5e0af8ca88f0b8e601f140058738a2c73362797b0b0

  • SSDEEP

    1536:nfXAelfTwM78NqibAEJH2pyoia3rPBafna/UfLVx+JJgXT0SqPTOnPym:fFZT1ANTblJH2p9bPBana/M5cYALQj

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 47 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c23de2328cb66ae54f6bd5032e2b3f8.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c23de2328cb66ae54f6bd5032e2b3f8.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3024

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3024-1-0x0000000000180000-0x0000000000182000-memory.dmp

          Filesize

          8KB

        • memory/3024-0-0x0000000010000000-0x0000000010020000-memory.dmp

          Filesize

          128KB