Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe
-
Size
18KB
-
MD5
a0ebf14cbabf0d46cbf6964c70b9fb1e
-
SHA1
26c5ab20042a713731f6afbb3beeef6101598b9c
-
SHA256
4deed0a50db8994a4fdc3e71debe3764f9e754d973a02818d76668a616d0d5f9
-
SHA512
5df0834d1fc83951bef2372493730a7575a168fca3c9b6aac2d637ff73414029902df132d7acc54c25a3becec39442bcd6194908446a0eefd8afa6d23a53f694
-
SSDEEP
192:QxBm1P2MhzKeuyVgo4o7V1yIrQ/ZAujw50tlhf/waqLUf7DE3:Qjmp2MhzH7rPMZAuj4uF/waJf7DE3
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{A67726D9-4100-4582-8620-5A7E27D3EC3B}\74.0 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\TypeLib\ = "{A67726D9-4100-4582-8620-5A7E27D3EC3B}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\ProgID\ = "prjDownSecD0925ZW.CVirus" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\Implemented Categories a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\TypeLib\ = "{A67726D9-4100-4582-8620-5A7E27D3EC3B}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\ProxyStubClsid32 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CVirus\ = "prjDownSecD0925ZW.CVirus" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}\Implemented Categories a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}\Programmable a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{A67726D9-4100-4582-8620-5A7E27D3EC3B} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\ = "_CFileDownload" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\TypeLib\Version = "74.0" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CVirus\Clsid a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\ProxyStubClsid a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{A67726D9-4100-4582-8620-5A7E27D3EC3B}\74.0\HELPDIR a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\ = "__CFileDownload" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\VERSION a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CVirus\Clsid\ = "{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CFileDownload\ = "prjDownSecD0925ZW.CFileDownload" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{A67726D9-4100-4582-8620-5A7E27D3EC3B}\74.0\0\win32 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\ = "CVirus" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\ProxyStubClsid a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\Programmable a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CFileDownload\Clsid\ = "{6F26ED6F-82C2-4B64-B1A7-40E644225E97}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\ProxyStubClsid a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}\LocalServer32 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CFileDownload a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\ProxyStubClsid32 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\TypeLib\ = "{A67726D9-4100-4582-8620-5A7E27D3EC3B}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\ = "CFileDownload" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\TypeLib\ = "{A67726D9-4100-4582-8620-5A7E27D3EC3B}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CVirus a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjDownSecD0925ZW.CFileDownload\Clsid a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{A67726D9-4100-4582-8620-5A7E27D3EC3B}\74.0\ = "prjDownSecD0925ZW" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\TypeLib a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\ProxyStubClsid32 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\ = "prjDownSecD0925ZW.CVirus" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}\TypeLib\ = "{A67726D9-4100-4582-8620-5A7E27D3EC3B}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}\VERSION a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\TypeLib\ = "{A67726D9-4100-4582-8620-5A7E27D3EC3B}" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\TypeLib\Version = "74.0" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B}\ = "_CVirus" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}\VERSION\ = "116.0" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{356C9BA2-F1AA-448F-A61D-8C28CB8A435B}\ProxyStubClsid32 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F8724BF-0FD8-403E-9B32-74D7BDEBAD2B} a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A2A91C03-FF9F-46A4-9517-7474C00ABB01}\TypeLib\Version = "74.0" a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3000 a0ebf14cbabf0d46cbf6964c70b9fb1e_JaffaCakes118.exe