Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 14:45
Behavioral task
behavioral1
Sample
afa486bf5c971f7d5b0514ef08700c09_JaffaCakes118.dll
Resource
win7-20240704-en
4 signatures
150 seconds
General
-
Target
afa486bf5c971f7d5b0514ef08700c09_JaffaCakes118.dll
-
Size
36KB
-
MD5
afa486bf5c971f7d5b0514ef08700c09
-
SHA1
29d942cd7e6db9d747728d29e5c0189cbe8a77a9
-
SHA256
cd4b4cde40d5795b51e33a20c9be420383a8fe2b35dc1e4a18c93517f640cc52
-
SHA512
8ac3e1a554bb58b82a7774f51fc76642165248010545177c4fbf824872ebaf6b74e92187502b9128ccd76a6329595ee24ab4f9e8433497216573f15499e02cba
-
SSDEEP
768:bhiZW2IYRiwjIlJ7G0Vc/1CbGPdsXZNWEWs9nbcuyD7URhQrl4n:bhiwKjuNRi/1CuspNWUnouy8zM4
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/772-0-0x0000000011000000-0x000000001103B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 45 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ = "_Sysctl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\TypeLib\ = "{CC866A13-8904-4C9D-85CA-715D6216A542}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sysct.Sysctl\ = "Sysct.Sysctl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ = "Sysctl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ = "_Sysctl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\TypeLib\ = "{CC866A13-8904-4C9D-85CA-715D6216A542}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\ = "Sysct.Sysctl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\afa486bf5c971f7d5b0514ef08700c09_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\afa486bf5c971f7d5b0514ef08700c09_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sysct.Sysctl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sysct.Sysctl\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\ = "Sysct" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\ProgID\ = "Sysct.Sysctl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sysct.Sysctl\Clsid\ = "{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\TypeLib\ = "{CC866A13-8904-4C9D-85CA-715D6216A542}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{CC866A13-8904-4C9D-85CA-715D6216A542}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CB638F4-7993-4F7B-8CDA-D7F1B054DC67}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB3B7ECA-52CA-49C8-8A63-05EEB021928A} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1652 wrote to memory of 772 1652 regsvr32.exe 30 PID 1652 wrote to memory of 772 1652 regsvr32.exe 30 PID 1652 wrote to memory of 772 1652 regsvr32.exe 30 PID 1652 wrote to memory of 772 1652 regsvr32.exe 30 PID 1652 wrote to memory of 772 1652 regsvr32.exe 30 PID 1652 wrote to memory of 772 1652 regsvr32.exe 30 PID 1652 wrote to memory of 772 1652 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\afa486bf5c971f7d5b0514ef08700c09_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\afa486bf5c971f7d5b0514ef08700c09_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:772
-