Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 14:30
Behavioral task
behavioral1
Sample
e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll
-
Size
62KB
-
MD5
e706499c4f284abd90245fb6ee7daf10
-
SHA1
f1d0ff86c649ad57228a6f78bb9edf0abeaf978a
-
SHA256
83f5a20ca03814eeaa6b3ca5d3fa76bcbbe62154e5860c6ea15a1502c447551d
-
SHA512
03c5387ba96ef56fc1a1755eb352bc0a02befcde1f581b69612a09c060c5f90e90c8df13bb3d3daf0f386308220eecfb8477712545e563d37a93becbf04ee529
-
SSDEEP
768:a3p1CaN8PSZjw6A/pnGEvCqmyQZhDeqcd+awPF8xNdeVW:y1CaNvZpipnG7yb0VPm/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\TypeLib\ = "{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\ = "MyBaner" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.MyBaner regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.MyBHO\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94FD42A-E405-4CD9-9486-3A341310EE2F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\TypeLib\ = "{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\TypeLib\ = "{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\ = "Intelinks" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\ = "_MyBaner" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94FD42A-E405-4CD9-9486-3A341310EE2F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.MyBaner\Clsid\ = "{A94FD42A-E405-4CD9-9486-3A341310EE2F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\ = "_MyBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\TypeLib\ = "{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.MyBaner\ = "winapi32.MyBaner" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\ = "winapi32.Intelinks" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\TypeLib\ = "{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94FD42A-E405-4CD9-9486-3A341310EE2F}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94FD42A-E405-4CD9-9486-3A341310EE2F}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94FD42A-E405-4CD9-9486-3A341310EE2F}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\ = "MyBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.Intelinks\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}\1.0\ = "winapi32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\ = "_MyBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.MyBaner\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\ = "_Intelinks" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\TypeLib\ = "{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADE60563-5AD0-4832-A1E7-0E3A428C43C4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BD2B2BC-D289-4FCE-B734-E4D6ACBBAB7D}\ = "_MyBaner" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winapi32.Intelinks regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7DFABBF-F985-4A67-8D72-EA0D9FC7C429}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A533235-A128-434B-9F8A-9300A544D191}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{018080B0-D90D-46F8-86D1-4CF8CE6E8686}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71228A-0D58-4E50-B592-36551F1ACC01}\Implemented Categories regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3652 wrote to memory of 668 3652 regsvr32.exe 82 PID 3652 wrote to memory of 668 3652 regsvr32.exe 82 PID 3652 wrote to memory of 668 3652 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e706499c4f284abd90245fb6ee7daf10_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:668
-