Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe
-
Size
309KB
-
MD5
43a45abc947e5b9b6c8a27796558a7a2
-
SHA1
cbcfb50d0f1153797fd72d9e0e980bb14b473c9f
-
SHA256
8ae1653767fc1a34bfbbece90a9e117ede958f48ba324909d65e2aad091e4256
-
SHA512
ad804c72a7e17400905e57d6a6cada2a87f372faae2e92673b95a4096f85ac21d5d6ed9895ebeed34504ff6ec1684a406a6158b0b1fc3c2af572cf9d199dadcd
-
SSDEEP
6144:ipUGBphL7j4LeHM3bt+n5Wz4zuKc2AZY7hksBN0d8F:ipUGBTcy44zuKuZhv8
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\d = "C:\\Program Files (x86)\\Internet Explorer\\ctfmonzfc.exe" regsvr32.exe -
Loads dropped DLL 1 IoCs
pid Process 2340 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\IExplore = "1" regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\yu85311.dll 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\ctfmonzfc.exe regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\VersionIndependentProgID\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\InprocServer32\ = "C:\\Windows\\SysWow64\\yu85311.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\TypeLib\ = "{E480D1FF-340C-3C01-B429-D46C40823361}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\yu85311.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\TypeLib\ = "{E480D1FF-340C-3C01-B429-D46C40823361}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\ = "IDOMYddh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\ = "IDOMYddh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6BCE6ACC-7888-33E6-959E-9EA3BFBD3BA9}\ProgID\ = "D.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\ = "LIB" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E480D1FF-340C-3C01-B429-D46C40823361}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDFE39D5-7F51-3BEE-B112-91EB92618975}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30 PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30 PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30 PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30 PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30 PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30 PID 2544 wrote to memory of 2340 2544 43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43a45abc947e5b9b6c8a27796558a7a2_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\yu85311.dll2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD57747a5f9ef000f8ada15e4e919225643
SHA16b17572ce746a4d375b57042e307141eb7da542b
SHA25690191b995f3b44ad7be62f99cbe342834ba3ea64d8185ca989d63686d07d0af1
SHA512ec1717dc4119f4cc0d7b268f57528528856b115f0c7f3d56a413236c38b61a0366235fd7bf25ba926236f9ab3fc9a792a0090171d2a5900c870a5b0d11de9af2