Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 17:18
Behavioral task
behavioral1
Sample
09d0afda209189bc26439073de79de19_JaffaCakes118.dll
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
09d0afda209189bc26439073de79de19_JaffaCakes118.dll
Resource
win10v2004-20240611-en
4 signatures
150 seconds
General
-
Target
09d0afda209189bc26439073de79de19_JaffaCakes118.dll
-
Size
189KB
-
MD5
09d0afda209189bc26439073de79de19
-
SHA1
26c1f76ac722b3d65d6f45c27e3cecc70e4916d3
-
SHA256
19c87040071c87324956411c4ebc5d2a73b04685015936d2f63c1fd55d9b632f
-
SHA512
b7da52370e4ad55c1095e4b14af2257ac5236f589d8e8adeda0c28dd0799d4a3c4f900855676fab8301e72f986e1a36c61b7e6e65c9b5468ed40fb57fde36117
-
SSDEEP
3072:MbcxSvyxobRomWCQGGIdmJ61mkQpYCo0ifQD7DhupRgkSBc86IMt2+T1MII:XhmfHpq4pgYCg4DAzgkwcjIMt2qM
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/448-1-0x00000000023E0000-0x000000000246A000-memory.dmp upx behavioral2/memory/448-0-0x00000000023E0000-0x000000000246A000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25} regsvr32.exe -
Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\09d0afda209189bc26439073de79de19_JaffaCakes118.nPremiereBar\Clsid\ = "{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\ = "&Premiere" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\09d0afda209189bc26439073de79de19_JaffaCakes118.nPremiereBar\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\09d0afda209189bc26439073de79de19_JaffaCakes118.nPremiereBar\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\ProgID\ = "09d0afda209189bc26439073de79de19_JaffaCakes118.nPremiereBar" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\Implemented Categories\{00021494-0000-0000-C000-000000000046} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\09d0afda209189bc26439073de79de19_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\09d0afda209189bc26439073de79de19_JaffaCakes118.nPremiereBar regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C7A1EFF-8DE4-4A81-94ED-266F8C4EEF25}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4952 wrote to memory of 448 4952 regsvr32.exe 84 PID 4952 wrote to memory of 448 4952 regsvr32.exe 84 PID 4952 wrote to memory of 448 4952 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\09d0afda209189bc26439073de79de19_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\09d0afda209189bc26439073de79de19_JaffaCakes118.dll2⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:448
-