Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe
-
Size
273KB
-
MD5
835abf994bf0040e41a551b7b658dcfb
-
SHA1
b9514d4983b74e605feab10f37318b44725388f2
-
SHA256
0895d21d420681cdb684ae9f23298c55cf112b76ac0a93ca2ac972dc34a3d89b
-
SHA512
b1f96ddaa6a2f5d8614c0788e64ed60f06f2861a393d58f9882bd12df8f53d1bff8ec7ed57e77295b58dc0e566810cd2471229022f4982592fe4c251e75ec8ee
-
SSDEEP
6144:zME1nmg1tDbJ5621YNxQzSll5CjKn/6By/zEs9hrIWOeUUu5v4:wgnJJU5CjKn/YyrZ9Z1UUo4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 216 STR01.exe -
Loads dropped DLL 1 IoCs
pid Process 2076 regsvr32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\STR01.exe 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\StRos.dll 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\StRos.dll 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\STR01.exe 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STR01.exe -
Modifies registry class 45 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\HELPDIR\ = "C:\\Windows\\System32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Core.StRos\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\ProgID\ = "Core.StRos" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Core.StRos\ = "Core.StRos" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ = "_StRos" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\ = "Core.StRos" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ = "StRos" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\ = "Core" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ = "_StRos" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\TypeLib\ = "{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Core.StRos\Clsid\ = "{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\StRos.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6967235-026C-43EE-BA5A-98EFFAEF9E52}\TypeLib\ = "{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\InprocServer32\ = "C:\\Windows\\SysWow64\\StRos.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4094FBA8-338F-4FC9-A80C-EBEEB127F20B}\TypeLib\ = "{0EA868A0-7D32-4210-BDED-CB4AB3E9B4D1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Core.StRos regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 216 STR01.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4584 wrote to memory of 216 4584 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe 86 PID 4584 wrote to memory of 216 4584 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe 86 PID 4584 wrote to memory of 216 4584 835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe 86 PID 216 wrote to memory of 2076 216 STR01.exe 88 PID 216 wrote to memory of 2076 216 STR01.exe 88 PID 216 wrote to memory of 2076 216 STR01.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\835abf994bf0040e41a551b7b658dcfb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\WINDOWS\SysWOW64\STR01.exe"C:\WINDOWS\system32\STR01.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /s C:\Windows\System32\StRos.dll3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2076
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD57e54a3c9ae3e6a966fb82fa58fadfd14
SHA187583bf4cd22c6874ce4110f0ebe220a8dd1f783
SHA256334d7546fa06caccbac03fc6b58778638ec8992cdb6d7953fea6fc4367757db8
SHA5128d9196e05d4056cd6178aa80f438467d6e567238ca82f2c0577792da29f08b81f985aa72cf15b6de6d3cfcb22299e7264d94634c36a646a50e8a5c601255a1d5
-
Filesize
932KB
MD50663da658f40d0fec5e0f55a3f2c3140
SHA10ce1d032f7fd52468456465e09b01d9119c30a5d
SHA2562a5ad12c31a560ac4c6c597cfde48250e17c1533a984af447222fd98f6bf8606
SHA512be6282293b69ac92fc31c6af92f43db011e0f1abd184af278c1ca090d17a8262422ee3e86f9333117d517291f751289dccb127fa52a8fcd054d4fca861dcd41d