Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 17:29
Static task
static1
Behavioral task
behavioral1
Sample
68889a25bdb6e40c347f5c3b168f8582_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
68889a25bdb6e40c347f5c3b168f8582_JaffaCakes118.dll
-
Size
2.5MB
-
MD5
68889a25bdb6e40c347f5c3b168f8582
-
SHA1
c855dbd2f7e14ba37c9078829e9ccf4891df5c7b
-
SHA256
85dd791c40037d7f20e230c804ffbbebb49335a90de28afa7e5b1291806c7152
-
SHA512
95aadc91cae4bea848f3f005edb7950f4799964fbf49e0a75e166d41796d13b717dc9e38aeb5380b63cc2c6ed0ca1554b0f1892f202c51863beebea52b7f9b9f
-
SSDEEP
24576:PHlItVZSTbQPU6LOil01RNFeCwt5JTWZ3V5otr1DD8YZlQ+Xwy6MB9YlKkIeH+T/:PrDy5rteYZlLAqLeKkZH+T/BISFlv
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c}\NoExplorer = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c} regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c}\ = "yourprofitclub" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68889a25bdb6e40c347f5c3b168f8582_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5bbffa6f-87b1-17e5-12d5-b1be6721c11c}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1344 5116 regsvr32.exe 83 PID 5116 wrote to memory of 1344 5116 regsvr32.exe 83 PID 5116 wrote to memory of 1344 5116 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\68889a25bdb6e40c347f5c3b168f8582_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\68889a25bdb6e40c347f5c3b168f8582_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1344
-