Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 12:17
Behavioral task
behavioral1
Sample
3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe
-
Size
17KB
-
MD5
3913f1cec4ef9df3251493637c2d582e
-
SHA1
6a8e6441d19c8f68cb42ac36295ed6d848224a44
-
SHA256
6422ced349755858fefaf0b5bc57cb9af3c01105bf211b70d182410f3c379ea0
-
SHA512
f3658fec83b87cbdba8cf975153ed906275eb59b3f796e802d85b5ba15eecc19cab1ba6220e51e38acb4275f8ee57be07aaa38c06f8fd480b2cd54add6ee1479
-
SSDEEP
384:xol/RjkO/vggqo3ekR6051/N9MzlidoXD47:xo9RQkqoW0Xl9MRND4
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00090000000233ef-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2704 iebtmm.exe -
Loads dropped DLL 1 IoCs
pid Process 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4924-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/files/0x00090000000233ef-2.dat upx behavioral2/memory/4924-5-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral2/files/0x0008000000023443-8.dat upx behavioral2/memory/2704-10-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4924-11-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/2704-12-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825} 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\ 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iexplorerfiles.com/redirect.php" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Search 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.alwayssearches.com/index.php?b=1&t=0&q={searchTerms}" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\SearchScopes 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Main 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825} 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\www = "www" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iebt.dll" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32\ThreadingModel = "Apartment" 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 2704 iebtmm.exe 2704 iebtmm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4924 wrote to memory of 2704 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 85 PID 4924 wrote to memory of 2704 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 85 PID 4924 wrote to memory of 2704 4924 3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3913f1cec4ef9df3251493637c2d582e_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\iebtmm.exeC:\Users\Admin\AppData\Local\Temp\iebtmm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5fde28916801999a9f1b0eea911a7c6d9
SHA1dc12e393c7d859896f86d53ff40d7abce5009bf1
SHA256ead8065f610639710f074541880d043467ecf0effea40c072f47e47ed8cfd967
SHA512dc191a9aea77b82b56d7f1d41e9668fcdc7bff30c5c23db250d32283b1752fff98b7cb9a49c7ccf6649c100305fe84985cbbcb107657d4bb60823a8501145270
-
Filesize
5KB
MD58a08b11b5cdf2228880c7a165caa4eaf
SHA1a34977b2139edcf6f52ae9e862f6ac05149b360a
SHA2568b79aea4209dedf0a56286f65682343a0cde93b50e0018f3ef1a52ad0a6f50fe
SHA5122558abef7f2b2a58b5a3c5272a03452cef9df32118c3b952482799a8da5756a4f98685db2f69aa72fc4acd1e8b7062e5be30af598d1d5228b07dd7092dde7b76