Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 11:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.dll
Resource
win7-20240220-en
3 signatures
150 seconds
General
-
Target
f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.dll
-
Size
562KB
-
MD5
f7df50d461bc6b6e42ecec5606cd032f
-
SHA1
052e9f427ce37f63c106b8e0deca5030a48a97b5
-
SHA256
4ee0244c54b854dd46c83974051d7fccfacd26ac511ff64774cb5094cced1b56
-
SHA512
c96514473639ceb8b61c937b33ef9accdd2225edffac8f8beae062870e2f91c3deccc7152d6db1837c93ff80e8308a8a16a5c28f39a6e9d56744e3f20936a645
-
SSDEEP
12288:w0Et9YDc/Tk4Po4wSSqodPF9C2vTgYnREu7Rt:YtWDcw4o4Ts/9CknKIR
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36} regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}\ = "sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.sh\ = "sh" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}\ProgID\ = "f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.sh regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.sh\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.sh\Clsid\ = "{CC01FC6C-99D4-4DB2-BBE5-4386CDA3CB36}" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28 PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28 PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28 PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28 PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28 PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28 PID 2360 wrote to memory of 3036 2360 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f7df50d461bc6b6e42ecec5606cd032f_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3036
-