Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
ea472e8c6c4144607552dec53682bd4d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ea472e8c6c4144607552dec53682bd4d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ea472e8c6c4144607552dec53682bd4d_JaffaCakes118.dll
-
Size
52KB
-
MD5
ea472e8c6c4144607552dec53682bd4d
-
SHA1
11486e4c7461580873b0d04fda77913031af0c0c
-
SHA256
38bc314f8e06e8f750624e2db01888d267626530c72a013ab6c7473efc5296af
-
SHA512
e9584e5c99fd1c4ab3b79c88d18f35d573a3aaa188e08ffe4caeb5eb3e82463e3b49d3bf29ae38008b33ff269bb866e7ce9e2a03a9dc6e9d2895e39672044ae4
-
SSDEEP
1536:miTIVQwssCcZVXTNQ/Spmdwik8FYGVrnouy8:miT6Q1iVZQ6phuYGBout
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ea472e8c6c4144607552dec53682bd4d_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30 PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30 PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30 PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30 PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30 PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30 PID 2972 wrote to memory of 1916 2972 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ea472e8c6c4144607552dec53682bd4d_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ea472e8c6c4144607552dec53682bd4d_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1916
-