Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
c84cba0a9a6072c5d96fd61c2593fb33_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
c84cba0a9a6072c5d96fd61c2593fb33_JaffaCakes118.dll
-
Size
60KB
-
MD5
c84cba0a9a6072c5d96fd61c2593fb33
-
SHA1
9b2d00f28dc74471954abd54f0a834a377095459
-
SHA256
cef265e14f21b304e3d7f38f2881d1e110875a26b682c71c7cb16b436a21eb43
-
SHA512
33c4e949b8f5c56a23f6c319c97b5485803e6a64c68e5210454a8fa49d5b9d3377cbbf3e5cc0ff972db9a51d065a27600d46c8a8e5fd716357978b94c35380dc
-
SSDEEP
768:0ZtivJMHZfeB62sRCpGF14gshUUwAAMBWWm4NlTQDqe2drQWFrQckc01f+:0ZtivEdMGjsX7BWWm4rTC2drQgrv0V+
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\ = "IECtrl Helper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38} regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl\CLSID\ = "{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\VersionIndependentProgID\ = "F2DayDll.IECtrl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\TypeLib\ = "{4A0CAEEF-416C-43D1-A937-5512A74FEA61}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\TypeLib\ = "{4A0CAEEF-416C-43D1-A937-5512A74FEA61}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl.1\CLSID\ = "{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\TypeLib\ = "{4A0CAEEF-416C-43D1-A937-5512A74FEA61}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl\CurVer\ = "F2DayDll.IECtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\ProgID\ = "F2DayDll.IECtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\C84CBA~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\ = "F2DayDll 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl\ = "IECtrl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\ = "IECtrl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c84cba0a9a6072c5d96fd61c2593fb33_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\F2DayDll.IECtrl.1\ = "IECtrl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\ = "IIECtrl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\ = "IIECtrl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E56CB68-A7C4-4E6C-8E48-386A3D2E58BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91C1AE56-D2C9-4017-8BF1-75EA182CEB38}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4A0CAEEF-416C-43D1-A937-5512A74FEA61}\1.0\HELPDIR regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30 PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30 PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30 PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30 PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30 PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30 PID 2732 wrote to memory of 2820 2732 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c84cba0a9a6072c5d96fd61c2593fb33_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c84cba0a9a6072c5d96fd61c2593fb33_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2820
-