Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 12:22
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Downloader.Win32.Small.abe.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Downloader.Win32.Small.abe.dll
- Size 45KB
- Sample261006-pkbnesbs2p
- SHA256 4df5da11411bbd869378068f0eb0254c7350b0ac6f5741dded442e8adbe6a60c
- MD5 db47051f357d79cf492cc9b4a7c94dc9
- SHA1 57c9c6af9668a4e6bb08890eecdea4d1522b7da2
- SHA512 7d6b75676b0e6c57563260bcf32ec23ab7086171f11a97612689019853ecbd05cb2a15a9777c344ae46c44be5488171efb60d8e99d113b48fc084104f46f09ea
- SSDEEP 768:nippK+E3s4Mgs85w343rE4bRb41hvxj83dk0yXIUGFhwWcEnoL3bW7:sylxMeEl1cqxZ3WPno27
- TLSH T17F23D04F77908156E4914A3009FBDDA16D75FF404DF0928F189AB19E7CF07B42F6426A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2432-0-0x0000000010000000-0x000000001001B000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\ = "IWWWInstall" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall.1\CLSID\ = "{7DBFDA8E-D33B-11D4-9269-00600868E56E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall\CLSID\ = "{7DBFDA8E-D33B-11D4-9269-00600868E56E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall\CurVer\ = "WebInstall.WWWInstall.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\VersionIndependentProgID\ = "WebInstall.WWWInstall" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\Insertable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\MiscStatus\1\ = "131473" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\TypeLib\ = "{CFBC1C51-D33C-11D4-9269-00600868E56E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan-Downloader.Win32.Small.abe.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JAFFAC~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JAFFAC~1.DLL, 101" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall\ = "WWWInstall Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\ProgID\ = "WebInstall.WWWInstall.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\ = "WWWInstall Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\ = "WebInstall 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFBC1C51-D33C-11D4-9269-00600868E56E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\ = "IWWWInstall" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFBC1C5D-D33C-11D4-9269-00600868E56E}\TypeLib\ = "{CFBC1C51-D33C-11D4-9269-00600868E56E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebInstall.WWWInstall.1\ = "WWWInstall Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DBFDA8E-D33B-11D4-9269-00600868E56E}\TypeLib\ = "{CFBC1C51-D33C-11D4-9269-00600868E56E}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4268 wrote to memory of 2432 4268 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.abe.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.abe.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2432
-