Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71.dll
- Size 140KB
- Sample261002-j8glpayfqf
- SHA256 80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71
- MD5 bd28d9b62f7cc4a847f572a92c2f959b
- SHA1 2b493d2c6dabd006cfed525e581d237faef15258
- SHA512 999043548cfc56075d1f85bbf26d1bd75b27797bf91de5190cec6b040d4caa1156edc75e6791cefe4f215273cbccf79ac9b2ce5c4fcd88068e0a966142d2233c
- SSDEEP 3072:/7GrYfN3Vj5jjsi1CZpL8P8bR/OBFikH/7WXk0j9Wpzm:DGrYBLWOBFikH/7BHz
- TLSH T1B0E3F922F392E41FDD8200752A1BB7FE0D286F325644910FB7C9EF4D593799AA822717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{998BC61C-1573-4D6B-89C8-260196B36D02}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\ = "_ClsNode" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40792F02-052B-4F21-865C-821CA1195F3A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4081C725-33B8-4983-A446-06C64165B508}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4081C725-33B8-4983-A446-06C64165B508}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\ = "__TreeBe" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D3B3271-F3C7-4799-811D-92851D680E94}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\ = "ClsNode" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PrjTreeBe.ClsNode regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{998BC61C-1573-4D6B-89C8-260196B36D02}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\ = "PrjTreeBe.TreeBe" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4081C725-33B8-4983-A446-06C64165B508}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC}\ = "_ClsNodes" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40792F02-052B-4F21-865C-821CA1195F3A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4081C725-33B8-4983-A446-06C64165B508}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PrjTreeBe.ClsNode\Clsid\ = "{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PrjTreeBe.TreeBe\ = "PrjTreeBe.TreeBe" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{998BC61C-1573-4D6B-89C8-260196B36D02}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4081C725-33B8-4983-A446-06C64165B508}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PrjTreeBe.ClsNode\ = "PrjTreeBe.ClsNode" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PrjTreeBe.TreeBe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{998BC61C-1573-4D6B-89C8-260196B36D02}\1.0\ = "PrjTreeBe" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{998BC61C-1573-4D6B-89C8-260196B36D02}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4081C725-33B8-4983-A446-06C64165B508}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\ = "_ClsNode" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265D66BE-EFE3-4B1B-BF8F-F3FAD3F882D8}\ProgID\ = "PrjTreeBe.TreeBe" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{998BC61C-1573-4D6B-89C8-260196B36D02}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4081C725-33B8-4983-A446-06C64165B508}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4081C725-33B8-4983-A446-06C64165B508}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47A1C972-A929-41A9-B36B-18DED745FDDC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40792F02-052B-4F21-865C-821CA1195F3A}\ = "__TreeBe" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D3B3271-F3C7-4799-811D-92851D680E94}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PrjTreeBe.ClsNodes\Clsid\ = "{5D3B3271-F3C7-4799-811D-92851D680E94}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE83AD01-0218-4B9A-B0E6-0397C15F9A6F}\ = "PrjTreeBe.ClsNode" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{936ABE04-8701-43DB-A606-A2B540673D18}\TypeLib\ = "{998BC61C-1573-4D6B-89C8-260196B36D02}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3812 2976 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_80a1686ff3164c4abbfd670aa46c5f628c1e89885216d726ac684fb0eec8af71.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3812
-