Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll
- Size 840KB
- Sample260924-dnxvaacf85
- SHA256 adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e
- MD5 5f777f08efecc65e562aa06233c82223
- SHA1 beba73c0762f05fd58cf2e12e87ef2e927dcfcd4
- SHA512 c7c140b701eb9301d6b7a0adc3f11995170f2089df7b10144ea3e26d1cbd34f4e734a9b31cb9efb83e7b963fa56e8fe336d989ea85c754708b4cd111c1fdc97e
- SSDEEP 12288:jdbi9ab2wlWTEu7A9okv1T0g8QDlZEFIC5+NQ:jdbuasTEiItqxyhK
- TLSH T161050A736B466339C223797A694992CF8114DE3129294E4DD2E52D48DE77F33B3022AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 55 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID\ = "cndr32a.Video" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation\Enabled = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\ = "FLW Viewer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll,-313" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\ = "Media Codec" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid\ = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32 regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4696 3564 regsvr32.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adb8ce525896b1123aa17da3c4299bc2c6d21c3cd0584058d86efad86498720e.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4696
-