Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 05:14
Behavioral task
behavioral1
Sample
d9ada34794569749f8578b8af067d7ee_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d9ada34794569749f8578b8af067d7ee_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d9ada34794569749f8578b8af067d7ee_JaffaCakes118.dll
-
Size
169KB
-
MD5
d9ada34794569749f8578b8af067d7ee
-
SHA1
d8690d9785198e1584bb460f783e2725316e7304
-
SHA256
9ccf6e2481f46524c9d44cd20161e3c504cc0694c2be5fa8777a1278a198f7bc
-
SHA512
dab8387bd290fe1c8a8f3192c749214ae72282e57052364c1ee3ff8080b62d40e1f372217c0c434f3afd1943d0f3f8165708d8bfed97f6948f46e8b6d4e72b6f
-
SSDEEP
3072:5sEbHRPr04GaVrftNsbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7+3lObZi:5pbhIna1SwvP6bQ7yMP+DE827nZi
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\ = "invoke 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8980BAB9-280E-4D05-A01B-A95DCDA1067D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d9ada34794569749f8578b8af067d7ee_JaffaCakes118.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2244 2248 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9ada34794569749f8578b8af067d7ee_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d9ada34794569749f8578b8af067d7ee_JaffaCakes118.dll2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2244
-