Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
fb6c34512f8f8853cee53197436b93be_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb6c34512f8f8853cee53197436b93be_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fb6c34512f8f8853cee53197436b93be_JaffaCakes118.dll
-
Size
52KB
-
MD5
fb6c34512f8f8853cee53197436b93be
-
SHA1
7c31e30588e1464d45ac3fddb650b0222c70dde8
-
SHA256
73b648b75cf608ae7532d0688390b78a50da4c96abe3c09bca98be801d69ccd2
-
SHA512
5c20b83a729b61b5f8e283ed964578e114bda97da841aa79f28fec5fb0b8fc1713f6e44233515744b77ac885697972c8b4801c57948cfd228548d2e61c4764ef
-
SSDEEP
1536:C83AGH1r7lkfcuzev+UP4fgmw/suDxR3RxcgCM0q:CPNyGUP4vw/scGM0q
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ ¤1½DÜ£Ó\ = "¦ó\x1fÅ\x13<Úѵ\x06÷_!Œ¢§8#\x7f«Fj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\¯«>²KA regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\¯«>²KA\Ƀ%ÏS=šÑعáE0ˆ®à& gî@+Û÷˜Îµ þS0º¾§94}½4 = "ع\x18áE0ˆ®à& gî\x03@+Û\x03÷˜Îµ\rþS0º¾§94}½4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\¯«>²KA\ = "Σ\fò{%\u0090±‡:2wÛ" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\¯«>²KA\ = "î§\x11ïL:‚æ¯+%\"ê\x1aM.ì" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\׊/ÀbͲž.w¼MD€I¼ñ´O»&ì¢öZ5‘¯µ(O—f regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\׊/ÀbͲž.w¼MD€I¼ñ´O»&ì¢öZ5‘¯µ(O—f\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb6c34512f8f8853cee53197436b93be_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ ¤1½DÜ£Ó regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1636 2516 regsvr32.exe 82 PID 2516 wrote to memory of 1636 2516 regsvr32.exe 82 PID 2516 wrote to memory of 1636 2516 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fb6c34512f8f8853cee53197436b93be_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\fb6c34512f8f8853cee53197436b93be_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1636
-