Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll
- Size 56KB
- Sample260924-dk835scf33
- SHA256 e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3
- MD5 89a5481a8fe349d04ed3f43e923293c9
- SHA1 4ee644369e05f4591fc362e896e76589eec60d81
- SHA512 d7d2db5e749b7b525de21c70cc32a734130644fc0ac6ddf0ceb4358e85068702125315fc984ee031e3a7aea06b53377cb432ef3cdc7ce287e1fe3d914a8c80db
- SSDEEP 384:SeYbQEPGqCZKPA23a9QjXtSZ54CKLUptEWuye7cw96h:/YbQ8CZKPfsQjIZyCr/EWKd
- TLSH T1BE43C52133D74EF1E68F26325A2B1B9D2852AD0457E061C71B8532BF8C732D6DF31A89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 55 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer.2 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\ = "IST 1.1 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\TypeLib\ = "{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer.2\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer\ = "Installer Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer\CLSID\ = "{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\ProgID\ = "ISTactivex.Installer.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\VersionIndependentProgID\ = "ISTactivex.Installer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\MiscStatus\1\ = "132497" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer.2\ = "Installer Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\ = "IInstaller" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\ = "IInstaller" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer\CurVer\ = "ISTactivex.Installer.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\ = "Installer Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\TypeLib\ = "{308A04D3-084D-43aa-A3E6-0D12BCCA3CE6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D128E6C8-6AE7-4ECD-939E-E2E6CA7D035D}\TypeLib\ = "{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer.2\CLSID\ = "{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ISTactivex.Installer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12398DD6-40AA-4c40-A4EC-A42CFC0DE797}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll, 101" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{308A04D3-084D-43AA-A3E6-0D12BCCA3CE6}\1.1\FLAGS regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5136 wrote to memory of 3524 5136 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e67cc29dc5efaf4fb0e2394255f97addb4a8f9ce5e657c61dc700a3e7f891fa3.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3524
-