Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
8d16b4b2f8c038283cf50667a1b2673a_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
8d16b4b2f8c038283cf50667a1b2673a_JaffaCakes118.dll
-
Size
684KB
-
MD5
8d16b4b2f8c038283cf50667a1b2673a
-
SHA1
aa72c01e7ec407948d56c44bf8caffc9f53fa402
-
SHA256
a4d218a60aaa96f27837196fe1b698dca30abba89c3ab3beaa660bfa506e7be7
-
SHA512
15c7dc83e615fdccbb535b852d8d8882b4141281fc22d662e55542dde8fab2da9e53116239610f88b406c02bbcc869a09a83f95486b61b863e45dc4fa63e9153
-
SSDEEP
12288:xTqAuC2lsh/CuJfVNXXSF70Mp3IYPU+KEfEgqIqptZY+jQTmFPapzGDGe7+:x/2+1CwXS5fp3Ixe+sTmta
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5}\NoExplorer = "\"\"" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5}\ = "coolblueads" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8d16b4b2f8c038283cf50667a1b2673a_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{735d7f0f-d3a9-4a93-15cd-05f10fd19ac5}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2184 3016 regsvr32.exe 84 PID 3016 wrote to memory of 2184 3016 regsvr32.exe 84 PID 3016 wrote to memory of 2184 3016 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8d16b4b2f8c038283cf50667a1b2673a_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8d16b4b2f8c038283cf50667a1b2673a_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2184
-