Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll
- Size 853KB
- Sample260924-dn5vwsyscx
- SHA256 b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e
- MD5 cec6e66ab509ea762beacbf4a67db57e
- SHA1 346a680d8b6a60acc64eae81018d13bf98dfe923
- SHA512 fe2756da122ff8ea7ec77cc4dc5403f874eca01b155a9dc53f645bf92d361ae66011f3f1aac44954d790701b328babb1a4bb04e605864ce417e39ec6501786ea
- SSDEEP 12288:gfvquQAqI8DRly83MyWAtemtKpQMhdgUEgwjTNtXDAuCUqeXooAvYPYaHFqrTHKr:g16W8QAdKJbgUEgwjTN6UJMLTHK
- TLSH T1D805B45263123863ECD3D5B8A428C369E444F5141FC49C46DBC36D0AFAFFA87E42679A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 55 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\ = "Media Codec" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kiasys.Video\Clsid\ = "{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\ProgID\ = "kiasys.Video" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\ = "Media Codec" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\AppID = "{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Elevation\Enabled = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kiasys.Video\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\TypeLib regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll,-313" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\ = "Media Codec" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\kiasys.Video regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\kiasys.Video\ = "Media Codec" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll\AppID = "{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53C4786E-B8BC-4245-97C4-C4AFFE28A8CA}\Elevation regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5392 wrote to memory of 4052 5392 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b3e78572423c2ba37b016601b4da0207214dab4f1255ce1da79a62a33708c43e.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4052
-