Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
fc6f5710617da1b8662391639005484e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc6f5710617da1b8662391639005484e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc6f5710617da1b8662391639005484e_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
fc6f5710617da1b8662391639005484e
-
SHA1
374cbdc4d919b2f8eb12926d62f10f36b5012d44
-
SHA256
a459ae8ff0c5a68bb41a5690433c33e11a38798e34662a6d77950c6ea3e6c5c7
-
SHA512
9a685d225675cee3ae1707dab3ee1700bff0157d32bf5136b76602e366144e8d3f6f069ff59f7b671f273f944af928b195421b835f1668b512400921dfc52416
-
SSDEEP
49152:kyoR6FDbTpKIYYvlTPSZq1yFtMyMpy7Rk47JKyAWkkP:kDAFv1KImq18PWGR0yAWZ
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fc6f5710617da1b8662391639005484e_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fc6f5710617da1b8662391639005484e_JaffaCakes118.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\Server fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscoree.dll" fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\ProgID fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\VersionIndependentProgID fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\ = "Microsoft Common Language Runtime Debugger Publisher" fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\InprocServer32\ThreadingModel = "Both" fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\InprocServer32\2.0.50727 fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\InprocServer32\2.0.50727\ImplementedInThisVersion fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\NotInsertable fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\ProgID\ = "ComPlusDebug.CorpubPublish.1" fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\VersionIndependentProgID\ = "ComPlusDebug.CorpubPublish" fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F} fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\InprocServer32 fc6f5710617da1b8662391639005484e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EDC71B7-9A3D-296F-9A3D-296F9A3D296F}\Server\ = "mscordbi.dll" fc6f5710617da1b8662391639005484e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc6f5710617da1b8662391639005484e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc6f5710617da1b8662391639005484e_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
PID:2856