Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:43
Behavioral task
behavioral1
Sample
c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe
-
Size
19KB
-
MD5
c0773499f3869edcf9e34efb357d2a0b
-
SHA1
a43af54dbf26dfc72530f3e6276156112c617197
-
SHA256
b493ac6dcc2e2048bbf8acb79f4295caf8ab5d115f0b7251b284429692c3fb0c
-
SHA512
ae6651b0a1f4b217bdafa3b7d94273f4b97b1236b29b4c3279981039bb89e2f65e2929a3ff76f120d42ecffb343e0cea8bfe78091d0015bba0198dba9b3ea8a2
-
SSDEEP
384:5tOx5k3hj5Mgw+37oVRlZIWTGMnV8LwLXUMivJBrR6FwW2:5cE355Mgd7v4QL6UMixBEwW
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000120fe-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1976 iebtmm.exe -
Loads dropped DLL 3 IoCs
pid Process 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2156-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/files/0x00070000000120fe-2.dat upx behavioral1/files/0x000700000001876c-6.dat upx behavioral1/memory/2156-8-0x00000000003E0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/2156-14-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/1976-18-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\ c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825} c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iebtmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iexplorerfiles.com/redirect.php" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Search c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.alwayssearches.com/index.php?b=1&t=0&q={searchTerms}" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825} c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\www = "www" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iebt.dll" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}\InprocServer32\ThreadingModel = "Apartment" c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 1976 iebtmm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2392 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2392 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2392 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2392 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 30 PID 2156 wrote to memory of 1976 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 31 PID 2156 wrote to memory of 1976 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 31 PID 2156 wrote to memory of 1976 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 31 PID 2156 wrote to memory of 1976 2156 c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0773499f3869edcf9e34efb357d2a0b_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe2⤵
- System Location Discovery: System Language Discovery
PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\iebtmm.exeC:\Users\Admin\AppData\Local\Temp\iebtmm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5a76553dd2ad81a6f2688d6e947690d06
SHA14f8b69e3c6738ace3b0a2bb7b591cfd328a2283f
SHA256aa3d84db58a98bebc050c25af2e03f7f5d62120bf8dca2f3c029b2e92eadf41e
SHA512d5e4fd4d2ad8d97c18f1e78f996bff55611025c6772f54d9f14850a68bbda5e124f575f4cf70a009fbfad7376ae6e6dc3f3521a394ed3f62747f6f76ab340d87
-
Filesize
5KB
MD521c32e17963f29e859bf9297a661c049
SHA17f99fd5599e223ae57a88478d9fc9cccbd90579d
SHA2562d4a3bf8a6ebbb60277ba3f780c143e8630ff3a4d5679f513b89fade3b3399ac
SHA512171bef14bce258d9b41606958bb765efb724aa71ba8872ecf35c1ee81dcc308bbfd5c3b26eb3b803f7ec759f5b6575e1f974d3a65430bae0c8d4fdbaa8a735d8