Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll
- Size 840KB
- Sample260924-dnzc4syscs
- SHA256 a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1
- MD5 1d3c052e6ede5f9533a24aee704e0e99
- SHA1 53fb4f160782c1f336e5dcda0b7d0911fbeb7d9c
- SHA512 536a83307b0aca118955b17b6606783417bf51c92c3bc9f1ec9515ebbcded9593c641622f73be646731d45a93ad50c4987167ee0238503d939f7792424a86cb5
- SSDEEP 12288:jdbi9ab2wlWTEu7A9okv1T0g8QDlZEFIC5+N8:jdbuasTEiItqxyhu
- TLSH T17C050A736B466339C223797A694992CF8114DE3129294E4DD2E52D48DE77F33B3022AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 55 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID\ = "cndr32a.Video" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\ = "FLW Viewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\ = "Media Codec" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid\ = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\AppID = "{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll,-313" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF50F68-ECAD-45C6-AFC1-B5DC4B95B15E}\Elevation\Enabled = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib\ = "{74D46BBA-5638-473A-83B6-97E7804A7411}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ = "IVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cndr32a.Video\Clsid regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1604 wrote to memory of 1636 1604 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a497b8d40411c9a144737163a589d04fb8c8a00b4c9e734e529e03adeccaceb1.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1636
-