Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 07:07
Behavioral task
behavioral1
Sample
04cd640e7410608a2431748c86cda646_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04cd640e7410608a2431748c86cda646_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
04cd640e7410608a2431748c86cda646_JaffaCakes118.exe
-
Size
17KB
-
MD5
04cd640e7410608a2431748c86cda646
-
SHA1
16c486a32f0a43eeb8705600c108570fbb1a37d0
-
SHA256
09ae7271c958773d1f2e7c32344c14b744b54e84bd4fe54edcf681fd660be347
-
SHA512
51f7dd044ae51b651d9a4d0e86aab53b233d0eda95682053dc8974c5076ef791bcaaead45b475cd298fcc820ab8ef7c43d86ccc4ac2b973588f72ab6d9be7bab
-
SSDEEP
384:GOdmqUQPMgEXh9qg0qT+91piJ0QcrjJDvPc2nf4:GOiuMag/K9SJeRPc2f
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\C:\Windows\fonts\mtbbpxpf.dll = "{4EAA8F86-4217-48D0-A976-389247780A14}" 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2768 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 2380 regsvr32.exe -
resource yara_rule behavioral1/memory/632-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/632-8-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\fonts\mtbbpxpf.tmp 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe File opened for modification C:\Windows\fonts\gzjxsj01.dat 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe -
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\0\win32\ = "C:\\Windows\\fonts\\mtbbpxpf.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl\CLSID\ = "{4EAA8F86-4217-48D0-A976-389247780A14}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\TypeLib\ = "{D67CE309-75A0-459B-8D62-3A5D74239542}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\ = "Igzjxatl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl.1\ = "gzjxatl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\VersionIndependentProgID\ = "JXSJ.gzjxatl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\ = "JXSJ 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\InprocServer32\ = "C:\\Windows\\fonts\\mtbbpxpf.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl.1\CLSID\ = "{4EAA8F86-4217-48D0-A976-389247780A14}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\ = "gzjxatl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\TypeLib\ = "{D67CE309-75A0-459B-8D62-3A5D74239542}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\ = "Igzjxatl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl\CurVer\ = "JXSJ.gzjxatl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\TypeLib\ = "{D67CE309-75A0-459B-8D62-3A5D74239542}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\HELPDIR\ = "C:\\Windows\\fonts" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{720637CE-65CC-4FCF-9EFA-EDBDE8BFD345}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JXSJ.gzjxatl\ = "gzjxatl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EAA8F86-4217-48D0-A976-389247780A14}\ProgID\ = "JXSJ.gzjxatl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D67CE309-75A0-459B-8D62-3A5D74239542}\1.0\HELPDIR regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2380 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 30 PID 632 wrote to memory of 2768 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 32 PID 632 wrote to memory of 2768 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 32 PID 632 wrote to memory of 2768 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 32 PID 632 wrote to memory of 2768 632 04cd640e7410608a2431748c86cda646_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\04cd640e7410608a2431748c86cda646_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04cd640e7410608a2431748c86cda646_JaffaCakes118.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\fonts\mtbbpxpf.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\04CD64~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD553adaec2b442ed8cda371fbca3af0502
SHA1b7a4786eecb3c00200a481d526129caa8aca41d2
SHA25605ff0b8ab0136670872c1a0325f5c25d0109147a60854fc54697dc6e25524ac1
SHA5125482e293505584bbd01231cdde59443d19335fa1293c34f775e2f474afc308c09c8c602a184d6a0b8e2a480159746dccb52245678dba28e76aa01caced405dc4