Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3435e570880...18.exe
windows7-x64
7435e570880...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$_2_/$R0.dll
windows7-x64
6$_2_/$R0.dll
windows10-2004-x64
6$_2_/$R2/N...4_.exe
windows7-x64
1$_2_/$R2/N...4_.exe
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$_2_/$R0.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
$_2_/$R0.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe
-
Size
121KB
-
MD5
435e570880d6aca6d294205fc08e7695
-
SHA1
a985ba7f09de7371f6c151194ced63807b13b6e3
-
SHA256
75df84ce51fba958aabc1d460c40406083753dfe8a66d7b4b8fb4c65675db1ad
-
SHA512
86d684d6eb73a1a2aa8540f47c7f682b01d1f289ba54d2f9ab62c04061177202617befde62848db37cd90eac2d837f69345a84292d34838e331c5b8c4d74a293
-
SSDEEP
3072:1KQXtg/sDHmJ945Q41S/HdrJckuzIsJjs0Oh8bFgG1jP:1NpuESfdr+ssV0OpjP
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 2436 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0} 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Intel\baiduc.dll 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe File created C:\Windows\Intel\baiduc.dll 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe File opened for modification C:\Windows\system.ini 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe File opened for modification C:\Windows\system.ini regsvr32.exe File opened for modification C:\Windows\Intel\baiduc.dll regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 41 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ThreadingModel = "Apartment" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{285AB8C5-FB22-4D17-8834-064E2BA0A6F0}" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR\ = "C:\\Windows\\Intel" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\ = "Info cache" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{285AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ = "C:\\Windows\\Intel\\baiduc.dll" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\ = "Pbtoo2s 1.0 Type Library" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS\ = "0" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ = "C:\\Windows\\Intel\\baiduc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0} 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0} 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32\ = "C:\\Windows\\Intel\\baiduc.dll" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}\ = "Info cache" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2436 2820 435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\435e570880d6aca6d294205fc08e7695_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" "C:\Windows\Intel\baiduc.dll" /s2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247B
MD53fc75fd12f6a9136c4ccac7bdd3271b5
SHA129c116909df81d5fe1608104209cc959be02ff23
SHA2560c0c27463ba1405116993c4f8ad5d4fcca86495e5eb912d9ccd2df862c0e7cfc
SHA5127787e9f8f50111d5f68e7ce48d8895dc06e3e24255193836fdb26e5bf4c79ed60d357b70c71f069f2119dfe7f31293dc4eb7f3d751fe72b0c1a6f8917c7331d8
-
Filesize
10KB
MD5bf01b2d04e8fad306ba2f364cfc4edfa
SHA158f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA256d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
SHA51230ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
-
Filesize
156KB
MD542748366d1edb36ffc9156932e52cf13
SHA11c2862acc20bb1d530340ae4c26d7b6337f5c07c
SHA25606d3bd3d155d93792a41eaf999bf2d45b9de1cb093622dafbfc7b634d8105244
SHA512ac7fdaa8bfa348ed62cce11109d3ad0d9a77494be5ad8202df98f0881c9ebe5bccd904839527b635e583b038440cff25a179abfbf741bdf4980de58c76d5f8c0