Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 08:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__84cb00424196a08061f50c4092b205f4.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__84cb00424196a08061f50c4092b205f4.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118__84cb00424196a08061f50c4092b205f4.dll
- Size 64KB
- Sample260919-kce9esdb78
- SHA256 8b119a3102fb270d93ffe953fa2a3ee694c4d7d73cb77d2a4b7c4b798dfc791c
- MD5 84cb00424196a08061f50c4092b205f4
- SHA1 82dc262464972b5b8afa2c16fb27bea4a53a7c34
- SHA512 c47813c16ee43c22c60a2659550d428979eb9d7ffe1f96a5bc7589d0bed2de3759cf49fa64f71b3eec41cf547354e5d1987dcde369ac4d18eb2c4ce1ccd63307
- SSDEEP 768:3IgGWJ/jvqe4Op2iCf0tFayBVg5z6FYdLwKUoVvG7HNQWWEqPyGrK:3Ig3/bZHFMkAJBv27xgyGrK
- TLSH T18453A425F2DBC13FF5C545B026ABEBAA18283E324A40D16FB786FB4C3A754D58421727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ = "_jimmycont" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\TypeLib\ = "{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ = "__jimmycont" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\Control\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ = "_jimmycont" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\VERSION\ = "12.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53B4380D-81FD-473F-A9A8-AB91CBD0BB97}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\TypeLib\Version = "c.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\TypeLib\Version = "c.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A049B6D9-DF5C-4C31-B6F5-D08C4711DBE4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A049B6D9-DF5C-4C31-B6F5-D08C4711DBE4}\Forward regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ = "jimmycont" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53B4380D-81FD-473F-A9A8-AB91CBD0BB97}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\ = "jimmyload" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jimmyload.jimmycont\Clsid\ = "{F420A442-7538-48DF-A3F1-C55BDE3BBB56}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__84cb00424196a08061f50c4092b205f4.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\TypeLib\ = "{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A049B6D9-DF5C-4C31-B6F5-D08C4711DBE4}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53B4380D-81FD-473F-A9A8-AB91CBD0BB97}\Forward regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\TypeLib\ = "{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jimmyload.jimmycont\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\TypeLib\ = "{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\TypeLib\ = "{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jimmyload.jimmycont regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A049B6D9-DF5C-4C31-B6F5-D08C4711DBE4}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\TypeLib\Version = "c.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ = "__jimmycont" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A049B6D9-DF5C-4C31-B6F5-D08C4711DBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jimmyload.jimmycont\ = "jimmyload.jimmycont" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53B4380D-81FD-473F-A9A8-AB91CBD0BB97}\ = "jimmycont" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\TypeLib\Version = "c.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5909FDE4-9958-4AE6-88E8-90159FFD5720}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F420A442-7538-48DF-A3F1-C55BDE3BBB56}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F249E4-DCB5-499E-B898-E748B9831CF4}\ = "jimmycont" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1F4E4B0-6CCC-4816-9C29-83F0AD2AE7E0}\c.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1272 wrote to memory of 6028 1272 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118__84cb00424196a08061f50c4092b205f4.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118__84cb00424196a08061f50c4092b205f4.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6028
-