Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe
-
Size
240KB
-
MD5
047658255b7bbddc5a257cf3ff215438
-
SHA1
aecdce6aff6df2a95dc730b7f37aa283b1571aee
-
SHA256
a019efaae1ae721215671a1b88c268bca9a79313be7520d6ed1a0ef531ff7cd3
-
SHA512
5a2b9dfec9606c500ae7502c425787ba2e986cccc6b516a4339fd057f8fe058260cc6714888a178d0b3fc673536c3e09247e91426a39b5159057354b5fdcf78d
-
SSDEEP
6144:h1OgDPdkBAFZWjadD4s5/ubqh5BFT/1H5:h1OgLdaOG65BNb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3056 507ff560dd976.exe -
Loads dropped DLL 4 IoCs
pid Process 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 3056 507ff560dd976.exe 3056 507ff560dd976.exe 3056 507ff560dd976.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C2D018CD-1970-8DA6-85C2-A187F3458187} 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C2D018CD-1970-8DA6-85C2-A187F3458187}\ = "wxDownload" 507ff560dd976.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C2D018CD-1970-8DA6-85C2-A187F3458187}\NoExplorer = "1" 507ff560dd976.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C2D018CD-1970-8DA6-85C2-A187F3458187} 507ff560dd976.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 507ff560dd976.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe -
NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x0007000000017403-10.dat nsis_installer_1 behavioral1/files/0x0007000000017403-10.dat nsis_installer_2 behavioral1/files/0x000500000001929a-49.dat nsis_installer_1 behavioral1/files/0x000500000001929a-49.dat nsis_installer_2 -
Modifies registry class 63 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\ = "wxDownload Class" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\Programmable 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx.4\CLSID\ = "{C2D018CD-1970-8DA6-85C2-A187F3458187}" 507ff560dd976.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\Programmable 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\VersionIndependentProgID\ = "507ff560dd9ae.ocx" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginBHO" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx.4\ = "wxDownload" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\wxDownload\\507ff560dd9ae.ocx" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "IIEPluginStorage" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx.4\CLSID 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx\ = "wxDownload" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\InprocServer32\ThreadingModel = "Apartment" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx.4 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\InprocServer32\ = "C:\\ProgramData\\wxDownload\\507ff560dd9ae.ocx" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\ProgID 507ff560dd976.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187} 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx\CurVer 507ff560dd976.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\VersionIndependentProgID 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\wxDownload" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx\CLSID\ = "{C2D018CD-1970-8DA6-85C2-A187F3458187}" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187} 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\ProgID\ = "507ff560dd9ae.ocx.4" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginBHO" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx\CurVer\ = "507ff560dd9ae.ocx.4" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 507ff560dd976.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\ProgID 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\VersionIndependentProgID 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\InprocServer32 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\507ff560dd9ae.ocx.507ff560dd9ae.ocx\CLSID 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "IIEPluginStorage" 507ff560dd976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 507ff560dd976.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187}\InprocServer32 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 507ff560dd976.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 PID 2100 wrote to memory of 3056 2100 047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe 30 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 507ff560dd976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{C2D018CD-1970-8DA6-85C2-A187F3458187} = "1" 507ff560dd976.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\047658255b7bbddc5a257cf3ff215438_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\7zSBA4A.tmp\507ff560dd976.exe.\507ff560dd976.exe /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5602aa39f9ab3b6685bee71c67dc485c5
SHA169cd0d6f9ce55a5e5d3d3559d31422303dc6def1
SHA256d8fb9c21b350a06449c7e6934a3c2d971d20851ce73938bbc5f79349f970721c
SHA5123bb5a0bf89da8993ae2801b41f7644ec39fc418ac0553bc67ed4f36ad413f3c2237ff9bcdd4a1ca64ad546b30e6445d3f6f1fa3af0f34faf1841da306e81ea94
-
Filesize
126KB
MD5d637295a8426c7c4a8e9ef3e584839a2
SHA155b64f53328498d22d269de2e65be2feeba7da00
SHA2565cbd7f4b8f991ccab51cfc1fd0a5437013c5196f3c636632d691103aa3708adb
SHA512f60f908b9f0efd4762255c9c71559bbd554714170262dd556353ddda55789d21cc3a8ade239cdf51da38dfa4e92714749c217095bccac19590ef8347ca501c8c
-
Filesize
4KB
MD5820e02d2a58fef7cf76d8d23d61a84b1
SHA1fb37fb0789e7e897567722c1dc60653bdf91c4ae
SHA25696db25268fb5446c2c7b2f5033ee182b50b00e638bfd0f90a5919d7fdfe7ff37
SHA512364b517f007cf9092c02f00982631d2637ecf56e5cfeaebb4831a1731d1ce482f5fe5958ab710adddad21ce4efdbaaa3416e8fd505a7ac1c3a8dc9ab38fa2017
-
Filesize
9B
MD599fa5d714d971a49b67de27e0d8871be
SHA1d0621e846ea60fa8d0b2c8e622e495af49cd7359
SHA256f560d76474380da948a0c5ab8682dc026822d9685268c592f315224b1b968bf6
SHA5122fec19e4f2a974227922a7e057890141523ae73fbfa127f9e8cd00dff71b29abb93cb865c6d74ecf3df8bca440c558d4fbf2f80e82cc9636320ab5edb95ebad5
-
Filesize
753B
MD54d7f66f35ee47101e69b096be2c6081e
SHA10521acfd1c936c40ef30bc84a75cb3ca6c5242e3
SHA2568871965c558f9d2d0a04970f32d70df4a137d5f47f6015682f055c76e46bd8b5
SHA51225116250287e0cc15fdfa5f4502ab91bccd95ec3836540996d4b79f32770ed49326ae96e9b897439c98288ecbe195dccb91eb31ef82377b0cbe58193fc318477
-
Filesize
65KB
MD56fce522ef2543f1cd8812f45c8718ba6
SHA1270c89c05963c0f24f976f6b75aa4d12ade4c837
SHA256d75c34545066eb787ed671c6d4ce4f4c6267637518ca683dfefb79f95f14226b
SHA512a0a486b95aeb9c059f23e639e16abdbfe94b041f33309b44e95743bf5a82f92d3c444c025b6c36a0dc296add3c2bc4f6affcf130014f16968be0afa8e0007880
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b