Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 04:02
Behavioral task
behavioral1
Sample
e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
-
Size
18KB
-
MD5
e92d48423426636c44cdaf8e16a22129
-
SHA1
001bb2a29e431bc21cbb0b8ec6e70edbbbb166b6
-
SHA256
7f50065b78e13e0ab94df1973f672fbe72a497953a67b54675e69ea2be5cb0bc
-
SHA512
03f85e32b45918009ba9934cb88f8473016d20311d52c1a9424f4f86390ace16739c677952fb2a9067adceef3e0873b6e21059c62e7670778d83b7d7704bb428
-
SSDEEP
384:rfCv/LONr7/AVnEZD2CM5JjzqKj8BcpextpKqI2moQgywUftt:rW/LONr7oVnkaCM7dj8BcpUtGafHct
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00090000000122be-2.dat acprotect behavioral1/memory/2896-13-0x00000000001B0000-0x00000000001B8000-memory.dmp acprotect -
Executes dropped EXE 1 IoCs
pid Process 2456 sbsm.exe -
Loads dropped DLL 3 IoCs
pid Process 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x00090000000122be-2.dat upx behavioral1/memory/2896-1-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2896-4-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral1/files/0x000c000000015c4c-6.dat upx behavioral1/memory/2896-13-0x00000000001B0000-0x00000000001B8000-memory.dmp upx behavioral1/memory/2456-15-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2896-16-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99BA268B-4021-4739-9945-3C774217FE75} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{99BA268B-4021-4739-9945-3C774217FE75}\ e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Search e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchesopen.com/index.php?b=1&t=0&q={searchTerms}" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.ietoolpro.com/redirect.php" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\xxx = "xxx" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32\ThreadingModel = "Apartment" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 2456 sbsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3040 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 28 PID 2896 wrote to memory of 3040 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 28 PID 2896 wrote to memory of 3040 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 28 PID 2896 wrote to memory of 3040 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 28 PID 2896 wrote to memory of 2456 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 29 PID 2896 wrote to memory of 2456 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 29 PID 2896 wrote to memory of 2456 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 29 PID 2896 wrote to memory of 2456 2896 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 29 PID 2456 wrote to memory of 2552 2456 sbsm.exe 30 PID 2456 wrote to memory of 2552 2456 sbsm.exe 30 PID 2456 wrote to memory of 2552 2456 sbsm.exe 30 PID 2456 wrote to memory of 2552 2456 sbsm.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe2⤵PID:3040
-
-
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵PID:2552
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c4c23c0e84d7e93646ffcc75a223f2df
SHA176d31fd1458c9214b7f3d198627c947e41ca091a
SHA2567dab81419287e7701fc28bf293975c9ef332c7b7ba89d42ae342cb6a905d55b3
SHA512f49d19adf6fe151334a821d1d890aa3f0d33e2fb29988d43b16fde2b44676cd6265d1c001fd6f791fb97acb71776ae07099e38756cd755355a5464aff3d81582
-
Filesize
5KB
MD5a75bb6cb77e48934cafb1636ddac8e40
SHA124f59e14dccd7909422c9565f4e2da9b8691b25c
SHA25616731a3ee7a14a35d3aafd4e5c1398fe68bed73882bbbb25534c71734c482786
SHA5124ca8b6528bf071406c1bff37ee8bc9488b9762335f731bdba2e171d17f1b048c3c848cfa5c46afa08f5f18c158dc03e89ef801ba5d5f71aa4c17fa1e60d68e51