Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll
- Size 840KB
- Sample260924-dnv1pacf83
- SHA256 ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6
- MD5 f33a70330cafb7013b27268a7da30d81
- SHA1 c81e2ff421b82e6c24c4254dc359b3d04f9c65ff
- SHA512 ff6319c866798e3ce0414890c317af8a2d7a6c2a125c4898dfc53554f3fef23c5a3a04b035c3a19b73ffe1fd2183ec46f61bb062fcc4aec764ac9765a7035150
- SSDEEP 12288:jdbi9ab2wlWTEu7A9okv1T0g8QDlZEFIC5+NL:jdbuasTEiItqxyh9
- TLSH T16E050A736B466339C223797A694992CF8114DE3129294E4DD2E52D48DE77F33B3022AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 55 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\ = "Media Codec" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid\ = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation\Enabled = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\ = "FLW Viewer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID\ = "cndr32a.Video" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll,-313" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2460 2312 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffd7bf0b85905883f212c317566d99a5d81893f2e6bb319ebf653eebee0365d6.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2460
-