Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 09:26
Behavioral task
behavioral1
Sample
388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll
-
Size
43KB
-
MD5
388fa83010a65f83a7a86aa7aa390d89
-
SHA1
26d8ecf5b6120d75493f483ced858d94d8c5e810
-
SHA256
0f4f3217150d2272bb70919ea611193bddb7d27061d068c0f1a309e2c8cd728b
-
SHA512
56f7c38f6f67d1d607d21d02b82030a570ec5a3f2bf8aec6e0e87b07463db414cd28c6911e6d394f4f59a691a3d53c7024d0f2120f75ab3f64a5a507a97c1cd6
-
SSDEEP
768:UyG4FRhxdtdDqSMD5GN1TucQn2SLcn116Av/8UcLq+35mTbJsE5C86QMMGopW:UyGwFdtdDqSM4NscO1Q1NvUUcLhubJsY
Malware Config
Signatures
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A78D29-52B1-4A7B-BAC0-1471BEDF9836}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31 PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31 PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31 PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31 PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31 PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31 PID 2324 wrote to memory of 2308 2324 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\388fa83010a65f83a7a86aa7aa390d89_JaffaCakes118.dll2⤵
- Modifies registry class
PID:2308
-