Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 13:08
Behavioral task
behavioral1
Sample
jaffacakes118__9504f4324326c0b0a838bd27910b3545.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target jaffacakes118__9504f4324326c0b0a838bd27910b3545.dll
- Size 31KB
- Sample260919-qc8hvsff76
- SHA256 22f6a9acf0e846296a4367a1d040cfd2116420e6211a6b65418d7c072aa37f9e
- MD5 9504f4324326c0b0a838bd27910b3545
- SHA1 20f0a83c66151bad4b4a1fc98ba8d7ed884540b0
- SHA512 c144ee9fb7b8911a978698862a34b54acf8d6480f229ca6eb43664143ccc1841ae4874a8e3c8957c2b97d0e485c22768b2ed3d286629a8e350922d435c5aad2f
- SSDEEP 384:ylmLbMAGZhYDQru4CqcokJXLESIniT0JablPrL8/lW62Ocn2Jc8amSpaMitxBZQv:IIoHzQ14viT0YlfOKq28hSM7BGQXzc
- TLSH T1DFE2DF8632CAD283F25B617A072196C7652DFC659EDFE36BB60D370CADF411A4D00A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\ = "BHO" regsvr32.exe -
resource yara_rule behavioral2/memory/5140-0-0x0000000010000000-0x0000000010015000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO\ = "BHO Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\TypeLib\ = "{223A26D8-9F91-42F6-8ED3-094B637DE020}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\ProgID\ = "BHO.BHO.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__9504f4324326c0b0a838bd27910b3545.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO\CLSID\ = "{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO.1\CLSID\ = "{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\ = "IGopher" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\ = "IGopher" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO.1\ = "BHO Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__9504f4324326c0b0a838bd27910b3545.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\VersionIndependentProgID\ = "BHO.BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\TypeLib\ = "{223A26D8-9F91-42F6-8ED3-094B637DE020}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO\CurVer\ = "BHO.BHO.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.BHO regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06CAD548-14DD-4fa3-9EA9-05F83C18CBD7}\ = "BHO Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{223A26D8-9F91-42F6-8ED3-094B637DE020}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\TypeLib\ = "{223A26D8-9F91-42F6-8ED3-094B637DE020}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CA5C07-7F5F-4502-8C77-99A91558ADD0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4636 wrote to memory of 5140 4636 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9504f4324326c0b0a838bd27910b3545.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9504f4324326c0b0a838bd27910b3545.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5140
-