Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe
- Size 36KB
- Sample260924-ej1aaaz18p
- SHA256 10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd
- MD5 eb700de9df3a95744c6247d458098351
- SHA1 f7f0d602f63d72f4512a0a945b185b4b2788d980
- SHA512 673325f5e6c06cb1f6551d6a8f57563b6a8915996a66e80fd63420ad2df1b97690a93ede3064d14707032fb1e66195059faa4cc6962ce932ed696a2632a6a220
- SSDEEP 384:XtbDJvUtAqARxaEEtszLVmPNiUAQ8jEdjc0JIVOT8S0ZE9wHKhqEeIwHKhqEe1ZR:XhJvyAqAR91Oiwdjc0JIVOozEq
- TLSH T124F27E65F38AD066F43B5E7018BE26D6C131BFE25A9A010772DC378D5F700C9AB08B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000024331-1.dat acprotect - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe - Loads dropped DLL 2 IoCs
pid Process 2608 regsvr32.exe 2564 regsvr32.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AddClass = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe" jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AddClass = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe" jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{834261E1-DD97-4177-853B-C907E5D5BD6E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{834261E1-DD97-4177-853B-C907E5D5BD6E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{834261E1-DD97-4177-853B-C907E5D5BD6E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe -
resource yara_rule behavioral1/files/0x000a000000024331-1.dat upx behavioral1/memory/2608-3-0x0000000010000000-0x0000000010015000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\dpe.dll jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe File created C:\Windows\dpe.dll jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\CustomizeSearch = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\CustomizeSearch = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Search regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\ = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl regsvr32.exe - Modifies Internet Explorer start page 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D\x01%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/" regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\ProgID\ = "AnalyzeIE.DOMPeek.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\TypeLib\ = "{BD0022A3-A43F-4F44-B64F-53EA7575F097}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\CLSID\ = "{834261E1-DD97-4177-853B-C907E5D5BD6E}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\CurVer\ = "AnalyzeIE.DOMPeek.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek.1\ = "DOMPeek Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\ = "DOMPeek Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097}\1.0\HELPDIR\ = "C:\\Windows\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\CurVer\ = "AnalyzeIE.DOMPeek.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\InprocServer32\ = "C:\\Windows\\dpe.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek.1\CLSID\ = "{834261E1-DD97-4177-853B-C907E5D5BD6E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\ = "DOMPeek Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ = "IDocEventHandler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\ = "DOMPeek Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\VersionIndependentProgID\ = "AnalyzeIE.DOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ = "IDocEventHandler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\TypeLib\ = "{BD0022A3-A43F-4F44-B64F-53EA7575F097}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AnalyzeIE.DOMPeek\ = "DOMPeek Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\VersionIndependentProgID\ = "AnalyzeIE.DOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\ = "{BD0022A3-A43F-4F44-B64F-53EA7575F097}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}\TypeLib\ = "{BD0022A3-A43F-4F44-B64F-53EA7575F097}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\InprocServer32\ = "C:\\Windows\\dpe.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\ProxyStubClsid32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{834261E1-DD97-4177-853B-C907E5D5BD6E}\ProgID\ = "AnalyzeIE.DOMPeek.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD0022A3-A43F-4F44-B64F-53EA7575F097}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1E68D42-02C4-465B-8368-5ED9B732E22D}\TypeLib\ = "{BD0022A3-A43F-4F44-B64F-53EA7575F097}" regsvr32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4824 wrote to memory of 2608 4824 jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe 87 PID 3044 wrote to memory of 2564 3044 jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\dpe.dll2⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_10648ca4fa6dacc21403f823014f0504ca47af81917e417a5cb8d233485178dd.exe1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\dpe.dll2⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:2564
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\dpe.dll
- Size 30KB
- SHA256 3a73b065861be9c8cff50f494a988f42c20fc36d59a04606bc2967ee89ed2de0
- MD5 e85236728923e4320e583df077b7d5df
- SHA1 db92f9347c685f6223a44cbea3cf3e2f5fbd5b15
- SHA512 24b0d64039e12c91eec7e8c91a41dbecd17aceca57ed04ccce10ca4605e8d5a3ce463bbf931367e6d294c3c1322a2040c79c4c85112e25f0bf8b198435979fe7
- SSDEEP 384:9UtAqARxaEEtszLVmPNiUAQ8jEdjc0JIVOT8S0ZE9wHKhqEeIwHKhqEe1ZP5:9yAqAR91Oiwdjc0JIVOozEq
- TLSH T112E26C65F38AD156F43B5E7458BD26D6C131BFE21AAA410771DC378C5FB00C8AB08BA9
- MD5 SHA1 SHA512 SSDEEP TLSH