Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61d29afb578fc117a0792796033ad211_JaffaCakes118.dll
Resource
win7-20240708-en
3 signatures
150 seconds
General
-
Target
61d29afb578fc117a0792796033ad211_JaffaCakes118.dll
-
Size
248KB
-
MD5
61d29afb578fc117a0792796033ad211
-
SHA1
3ee95a363072a43cf4549cd2987f618fe9bbcb57
-
SHA256
ecb24b3e3edcc169201855861077d62e3af6ba44ec9a8e5ffee7db1af0ddb439
-
SHA512
4dcaaa0679b5e159ee2bef8949d7be5a24df9b047ae616e9c02a7ef42f006c67b9930c3dc05f9b1258d63fb373dbfb65f535940cc9fadbf9ccf72c69bc4b1626
-
SSDEEP
6144:IOiYcaclk1K3rEhxOnfLCAd3Anq+szf1d1J1:alV3rEhuyndsd9
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8} regsvr32.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\61d29afb578fc117a0792796033ad211_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\wversion = "4.1.6" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8}\ = "JavaSunSurf Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\webbrowser = "{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{686488AF-13D5-9DDF-4FEF-9FB88698CFC1}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{686488AF-13D5-9DDF-4FEF-9FB88698CFC1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{686488AF-13D5-9DDF-4FEF-9FB88698CFC1}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{686488AF-13D5-9DDF-4FEF-9FB88698CFC1}\InprocServer32\ regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{686488AF-13D5-9DDF-4FEF-9FB88698CFC1}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30 PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30 PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30 PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30 PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30 PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30 PID 1596 wrote to memory of 1708 1596 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\61d29afb578fc117a0792796033ad211_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\61d29afb578fc117a0792796033ad211_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1708
-