6611a742becaa47302a41eccdcf8e17f973af175cb10d5b1009cbda6b6f292f1

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__29dcf7385777d95c3bd5eaaa7a2dcc6b.dll
Size 204KB
Sample260920-24fspsvsfw
SHA256 6611a742becaa47302a41eccdcf8e17f973af175cb10d5b1009cbda6b6f292f1
MD5 29dcf7385777d95c3bd5eaaa7a2dcc6b
SHA1 396645a04587dcfec1b39680ef9724c6b651489f
SHA512 4325b2812f6476fb388c7357350d82e3c7e8677dbd0c3b3b01d50c3cddb2c278c53613212d6643cd2212b96885daba8710519d2c4d358dbf6ec1f7767fd1904f
SSDEEP 6144:i10B0WUkNEbE94ErY/MVqGufINswegE65NhM:i10ByRMVVufINsSx3G
TLSH
T10B14E05C43900EB6D95207B788AAD39C7E410DA9CFD4D3A8901365221EF271E8FFF91A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5092	regsvr32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	5092	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32mgr.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{510A8D14-F2BF-4AE0-82D8-9A134296454C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__29dcf7385777d95c3bd5eaaa7a2dcc6b.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{510A8D14-F2BF-4AE0-82D8-9A134296454C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\ProxyStubClsid32\ = "{510A8D14-F2BF-4AE0-82D8-9A134296454C}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\ = "DIHPNetworkRediscovery"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{510A8D14-F2BF-4AE0-82D8-9A134296454C}\NumMethods\ = "29"	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3164	4940	regsvr32.exe	89
PID 3164 wrote to memory of 5092	3164	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29dcf7385777d95c3bd5eaaa7a2dcc6b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29dcf7385777d95c3bd5eaaa7a2dcc6b.dll
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\regsvr32mgr.exe
    C:\Windows\SysWOW64\regsvr32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 480
      4⤵
      Program crash
      PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5092 -ip 5092
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

regsvr32mgr.exe

Path C:\Windows\SysWOW64\regsvr32mgr.exe
Size 175KB
SHA256 9abd3761ca59a14e479dd7cc16acae67dcc81b145f5400785d9a8d11c5182fa0
MD5 7f077af519dccbe9d89ae8c5e02e8a20
SHA1 bcee09a12ffb2c1f29f47d99755b1068121250e3
SHA512 61a5f453bf27372e7984c564c1f7e9b43e60e2246a615a2c7bcc4e46120fe94bdcd6965cb3c8c2510cc8da4a8d0afa46d038be000fdad6568669f5bb623b1e0d
SSDEEP 3072:rcT1XVc5usmtYRTEpeA1keZEVtoWyRhEuRFa7oJMZ7sEH0zqFIsvXaVk30E5f:oTxVc8smtY2peqkeiwWWhvvo7RhIs/ai
TLSH
T1CA0402493615738CE15C06331536C238CDA3F4D6A72B4FB3B28DD19EA9743E67664BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3164-2-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/5092-5-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/5092-7-0x0000000000400000-0x000000000049A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads