Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 20:04
Behavioral task
behavioral1
Sample
ac63e56e529dc14dae53f1cfc41d1d17_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ac63e56e529dc14dae53f1cfc41d1d17_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ac63e56e529dc14dae53f1cfc41d1d17_JaffaCakes118.dll
-
Size
144KB
-
MD5
ac63e56e529dc14dae53f1cfc41d1d17
-
SHA1
2fa3f79648f5be4ff960e451ee53f5a6a242e9dd
-
SHA256
1558b7657ea33b55efc650c9aadac3cf005a0d5fe372021577a39f8cd4d9b0cf
-
SHA512
a62feb8570aa71a7d16966200d7bf92b6de35e1fec9ea528a5321e177f95abb1ac3349929980f2f67c3cf587137c5e50eb84e6a8b12d3984af53f388b93d4b0d
-
SSDEEP
3072:Rd8iQHqno6bbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7v+xM:XBwvP6bQ7yMP+DE827WxM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac63e56e529dc14dae53f1cfc41d1d17_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4400 wrote to memory of 4936 4400 regsvr32.exe 84 PID 4400 wrote to memory of 4936 4400 regsvr32.exe 84 PID 4400 wrote to memory of 4936 4400 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac63e56e529dc14dae53f1cfc41d1d17_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ac63e56e529dc14dae53f1cfc41d1d17_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4936
-