Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 04:02
Behavioral task
behavioral1
Sample
e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe
-
Size
18KB
-
MD5
e92d48423426636c44cdaf8e16a22129
-
SHA1
001bb2a29e431bc21cbb0b8ec6e70edbbbb166b6
-
SHA256
7f50065b78e13e0ab94df1973f672fbe72a497953a67b54675e69ea2be5cb0bc
-
SHA512
03f85e32b45918009ba9934cb88f8473016d20311d52c1a9424f4f86390ace16739c677952fb2a9067adceef3e0873b6e21059c62e7670778d83b7d7704bb428
-
SSDEEP
384:rfCv/LONr7/AVnEZD2CM5JjzqKj8BcpextpKqI2moQgywUftt:rW/LONr7oVnkaCM7dj8BcpUtGafHct
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000023209-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 4916 sbsm.exe -
Loads dropped DLL 1 IoCs
pid Process 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3100-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/files/0x0008000000023209-2.dat upx behavioral2/memory/3100-3-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral2/files/0x0007000000023211-8.dat upx behavioral2/memory/4916-10-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3100-11-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4916-12-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99BA268B-4021-4739-9945-3C774217FE75} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99BA268B-4021-4739-9945-3C774217FE75}\ e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Search e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.ietoolpro.com/redirect.php" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchesopen.com/index.php?b=1&t=0&q={searchTerms}" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\SearchScopes e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Main e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\xxx = "xxx" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75}\InprocServer32\ThreadingModel = "Apartment" e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99BA268B-4021-4739-9945-3C774217FE75} e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 4916 sbsm.exe 4916 sbsm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3100 wrote to memory of 4916 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 86 PID 3100 wrote to memory of 4916 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 86 PID 3100 wrote to memory of 4916 3100 e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e92d48423426636c44cdaf8e16a22129_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c4c23c0e84d7e93646ffcc75a223f2df
SHA176d31fd1458c9214b7f3d198627c947e41ca091a
SHA2567dab81419287e7701fc28bf293975c9ef332c7b7ba89d42ae342cb6a905d55b3
SHA512f49d19adf6fe151334a821d1d890aa3f0d33e2fb29988d43b16fde2b44676cd6265d1c001fd6f791fb97acb71776ae07099e38756cd755355a5464aff3d81582
-
Filesize
5KB
MD5a75bb6cb77e48934cafb1636ddac8e40
SHA124f59e14dccd7909422c9565f4e2da9b8691b25c
SHA25616731a3ee7a14a35d3aafd4e5c1398fe68bed73882bbbb25534c71734c482786
SHA5124ca8b6528bf071406c1bff37ee8bc9488b9762335f731bdba2e171d17f1b048c3c848cfa5c46afa08f5f18c158dc03e89ef801ba5d5f71aa4c17fa1e60d68e51