Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7eb3b28c3e7...18.exe
windows7-x64
3eb3b28c3e7...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/msearch.exe
windows7-x64
7$TEMP/msearch.exe
windows10-2004-x64
7Monkey3.exe
windows7-x64
Monkey3.exe
windows10-2004-x64
Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 11:24
Behavioral task
behavioral1
Sample
eb3b28c3e78c852f9ac378afc5483e94_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eb3b28c3e78c852f9ac378afc5483e94_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/msearch.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$TEMP/msearch.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Monkey3.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Monkey3.exe
Resource
win10v2004-20240802-en
General
-
Target
$TEMP/msearch.exe
-
Size
58KB
-
MD5
b7e8059927e84385fdf6bc7d73a072e0
-
SHA1
387b5bd41d1833119b7a936781f561de2bcf9ef8
-
SHA256
bd46c539a3bacd4f40171bc441f0baa9aea1821d539e5b94212efae69931a316
-
SHA512
3335e7c4e9497b4bd5f6cecd114aa62b11d8ea4fd0fcbfdc013b1af8c5872a5a77c917f7b28891fd6d0c6b789b7677060d14badf1f9794580a2a2969cb68202e
-
SSDEEP
1536:vUkhxvEP3fMYqM3WPVjyviqoXqtjqENd/avWX9ws3ic:MWM/fMYr3gVwi0tuC/auX9s
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2488 MSearch.exe -
Loads dropped DLL 1 IoCs
pid Process 4780 regsvr32.exe -
resource yara_rule behavioral8/memory/2336-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral8/memory/2336-23-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSearch = "C:\\Program Files (x86)\\MSearch\\MSearch.exe" MSearch.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA} regsvr32.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\MSearch\MSearch.dll msearch.exe File created C:\Program Files (x86)\MSearch\MSearch.exe msearch.exe File created C:\Program Files (x86)\MSearch\uninstall.exe msearch.exe File created C:\Program Files (x86)\MSearch\Install.ini msearch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSearch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msearch.exe -
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl\CLSID\ = "{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\0\win32\ = "C:\\Program Files (x86)\\MSearch\\MSearch.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\MSearch\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl.1\CLSID\ = "{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl\CurVer\ = "MSearch.MSearchCtl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\ProgID\ = "MSearch.MSearchCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\TypeLib\ = "{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\TypeLib\ = "{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\InprocServer32\ = "C:\\Program Files (x86)\\MSearch\\MSearch.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\ = "IMSearchCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\VersionIndependentProgID\ = "MSearch.MSearchCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\TypeLib\ = "{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\ = "IMSearchCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl.1\ = "MSearchCtl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\ = "MSearchCtl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9E3E05-B7E1-4C8D-AB28-44682ADA8CFD}\1.0\ = "MSearch 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSearch.MSearchCtl\ = "MSearchCtl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08C21C-9E7B-45CD-A9FB-C2EA2574DCAA}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FBBF5C6-E439-4B07-8D31-FD6F6DB616E9}\TypeLib regsvr32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 msearch.exe 2336 msearch.exe 2336 msearch.exe 2336 msearch.exe 2488 MSearch.exe 2488 MSearch.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2336 wrote to memory of 4780 2336 msearch.exe 82 PID 2336 wrote to memory of 4780 2336 msearch.exe 82 PID 2336 wrote to memory of 4780 2336 msearch.exe 82 PID 2336 wrote to memory of 2488 2336 msearch.exe 83 PID 2336 wrote to memory of 2488 2336 msearch.exe 83 PID 2336 wrote to memory of 2488 2336 msearch.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\msearch.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\msearch.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\MSearch\MSearch.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4780
-
-
C:\Program Files (x86)\MSearch\MSearch.exe"C:\Program Files (x86)\MSearch\MSearch.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD50866c83ffb0212ef77bd389ec86ca958
SHA1071d60f432034a7d7864ba4359702938caa18553
SHA256ed5e8047f64a56808d514c4b31a6c45f406bbc85333f51435fa6745bebe66ea2
SHA512552135a035af04b413fb53d6a2ef5a495511b187d493b9c30a9766b75c98572fff578d5467c8aee72662ca3c72a3498b5af19a4825b1f0e8ccc89efa6d213c7b
-
Filesize
96KB
MD54ae1045306b38a95b715c4694e5e66d7
SHA10d606473c952c49f32e94e1fda07a38752fb4c14
SHA256b92152c350d06dc7206af5d20c224e1a46a23cec2da29b4f48b2431a8724a086
SHA512b495f16c1a34aeb6bf26a4f3d16cda8b9b5545247b1d92b776f515ab238b14bbbd118f047f453cfc079f30b921ec790ecbeeba5384874a354fd3656dbdd54d33
-
Filesize
24KB
MD5b418c9d9eedc7c77a2d6d7dd8649126e
SHA1a9c34a4c268624c243c51f839a382ec62138990e
SHA2567ee8b73f90c1eb4c0c061bb7f9051ab043fa66fc69b9069fa71039d3bd278a6b
SHA512b32cb45d6f3ba80d6275e93a5f836a722858159a184a68e1027a8bb3fefcf62ba004b9814292aa8145f8bec3bbca7844553b6602526fa55ea7da994d6163fe9d