Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 19:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
150 seconds
General
-
Target
70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe
-
Size
673KB
-
MD5
70ef2c696b5c4619649cff99199175cb
-
SHA1
8adea59a32374eb3472a901c8d616a3d3df3e92e
-
SHA256
5cded815c3345397e14559301b62f9722af8d0bed5c414b218c465d352ec8c13
-
SHA512
7247f7a235db16b2826f34cee91f4955505311db1ccf0e3b38710d94c31c265fbb0fc62b9b56fc537cdddb6a4951b82e79e5f9642bff77cc49482dea597cc906
-
SSDEEP
12288:95NYhaZ88m6KTf2o6zaaoVbayAzGZnfG+84DpVg6l/tSHNm:95yhOiTf2rz0JwWxgs5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation BJSetup.exe -
Executes dropped EXE 2 IoCs
pid Process 4936 BJSetup.exe 2180 setup_000026.exe -
Loads dropped DLL 64 IoCs
pid Process 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60} Regsvr32.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~1\QVOD27\QvodEx.dll BJSetup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ime\SPTIPIMERS.ini BJSetup.exe File created C:\Windows\newicon.ico 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_000026.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.7322.com" BJSetup.exe -
Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O)\Command 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell BJSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QvodEx.QvodExtend\ Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O) 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\ÊôÐÔ(&D)\Command 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\ÊôÐÔ(&D) 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage BJSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\ = "Internet Explorer" 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command BJSetup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}\InprocServer32\ = "C:\\PROGRA~1\\QVOD27\\QvodEx.dll" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QvodEx.QvodExtend Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QvodEx.QvodExtend\Clsid Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\ShellFolder\Attributes = "10" 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID BJSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O)\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE http://www.131u.com/?1" 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\ShellFolder 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QvodEx.QvodExtend\Clsid\ = "{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A} 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\DefaultIcon\ = "C:\\Windows\\newicon.ico" 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O)\ = "Open(&O)" 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\ÊôÐÔ(&D)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}\ Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\DefaultIcon 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} BJSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53AC8551-0DE0-4606-8A1E-A51AF20ADD60}\ProgID\ = "QvodEx.QvodExtend" Regsvr32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2788 wrote to memory of 4936 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 84 PID 2788 wrote to memory of 4936 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 84 PID 2788 wrote to memory of 4936 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 84 PID 2788 wrote to memory of 2180 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 85 PID 2788 wrote to memory of 2180 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 85 PID 2788 wrote to memory of 2180 2788 70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe 85 PID 4936 wrote to memory of 2712 4936 BJSetup.exe 86 PID 4936 wrote to memory of 2712 4936 BJSetup.exe 86 PID 4936 wrote to memory of 2712 4936 BJSetup.exe 86 PID 4936 wrote to memory of 3368 4936 BJSetup.exe 87 PID 4936 wrote to memory of 3368 4936 BJSetup.exe 87 PID 4936 wrote to memory of 3368 4936 BJSetup.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70ef2c696b5c4619649cff99199175cb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\BJSetup.exe"C:\Users\Admin\AppData\Local\Temp\BJSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe /s C:\PROGRA~1\QVOD27\QvodEx.dll3⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DelTemp.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_000026.exe"C:\Users\Admin\AppData\Local\Temp\setup_000026.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD53405318f573c251a4b6b5f38b4f43d40
SHA1528faadf2823f7b1cb3ffc73268a5d20b0985aa1
SHA256f68d9bb639b873caedfc8fa316789f9dcbabb9c3aa0496a659164362422cbc4b
SHA5129d7cd852bfb04aaf3adee91964b129b995efa7367a0f201e863230f982101c15f60cb6b87ed473d6bb05d5b7b2d322ed685cee434648a9116a296a55d4a95fc1
-
Filesize
4KB
MD5073d44e11a4bcff06e72e1ebfe5605f7
SHA15f4e85ab7a1a636d95b50479a10bcb5583af93f3
SHA256b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
SHA512e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
77KB
MD5a0f03b0ea0bc411f39827363aafc6eb2
SHA1755ce9e59c19a22a3db66dfc4b3c65434b5f3519
SHA2562640d8b199c895891e1d37796c56423422072d15ac7c194e25841be7ac6638e9
SHA512af9add92c83c3a0efa295e61c717f328fd2997e5edaafacdc050dc325c5dac48e4dec4338842eeb9f2c54e2504d2291aabaa59e79f6e2d2e05891c728b96b498