Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
3f9688a9a6858d83ae238d88358f4333_JaffaCakes118.dll
Resource
win7-20240708-en
2 signatures
150 seconds
General
-
Target
3f9688a9a6858d83ae238d88358f4333_JaffaCakes118.dll
-
Size
113KB
-
MD5
3f9688a9a6858d83ae238d88358f4333
-
SHA1
d78d3ff8f07026869955588065754168a11ca201
-
SHA256
6631d1de3970c538864c2d92bf7f45ebced5a854cee4657b10d1168da13c773a
-
SHA512
76da746eeba3e0da8d775261d278cd425780e4926cd6dbe1808d6bfc911d7a4e8acf2315905f3d985e24b2928355f3913c5814b7dd6f8a48a05d089982d9d3ab
-
SSDEEP
3072:uAea9u+6xDPdTaTadGMwlm0lSyAtlmyZECK:Pu+opK9tgTyalmNCK
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1163E531-B58E-4BB9-B877-0906A0A22AEC} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1163E531-B58E-4BB9-B877-0906A0A22AEC}\NoExplorer = "1" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4896 wrote to memory of 688 4896 regsvr32.exe 83 PID 4896 wrote to memory of 688 4896 regsvr32.exe 83 PID 4896 wrote to memory of 688 4896 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f9688a9a6858d83ae238d88358f4333_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3f9688a9a6858d83ae238d88358f4333_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
PID:688
-