Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
12b26c5685c100b7647b1f2802f6505e_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
12b26c5685c100b7647b1f2802f6505e_JaffaCakes118.dll
-
Size
41KB
-
MD5
12b26c5685c100b7647b1f2802f6505e
-
SHA1
0baafef541fb2045445e81e23872cf805d4f013c
-
SHA256
c6dc7c747957db7961d47ee7d224c364f434b4e130a8753fa7e8c8e829a6b580
-
SHA512
cfc4e8e519859a9e9c2a66ce43a05949e986fea8d7f3a1672e4dc0130f79b1bdd1f4d784883363770301781a6a04991a8d3552ad4e50e5c84338342b573f80b8
-
SSDEEP
768:4gTrL1xJddyW9QtPW1pVHkmTHzHtCo9+QDbUGTs:4S/JGUQtPWhEmTHzHAo4QDbUGTs
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B85BB239-F685-4547-B0AC-E8835CD8ED24} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ = "OneSecurity" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1\CLSID\ = "{B85BB239-F685-4547-B0AC-E8835CD8ED24}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\VersionIndependentProgID\ = "OneSecurity.IESecurity" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12b26c5685c100b7647b1f2802f6505e_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ProgID\ = "OneSecurity.IESecurity.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\ = "SpywareNo IE Security 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\ = "{4EEAFD15-6A8A-4957-8932-259100D9C18B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CLSID\ = "{B85BB239-F685-4547-B0AC-E8835CD8ED24}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\ = "{4EEAFD15-6A8A-4957-8932-259100D9C18B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12b26c5685c100b7647b1f2802f6505e_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ = "IGopher" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\CurVer\ = "OneSecurity.IESecurity.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\ = "IGopher" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity\ = "One Security IE Security Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E81A8BAF-B19C-4857-9A78-26419429134D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\ = "One Security IE Security Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B85BB239-F685-4547-B0AC-E8835CD8ED24}\TypeLib\ = "{4EEAFD15-6A8A-4957-8932-259100D9C18B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4EEAFD15-6A8A-4957-8932-259100D9C18B}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OneSecurity.IESecurity.1\ = "One Security IE Security Class" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3288 4820 regsvr32.exe 82 PID 4820 wrote to memory of 3288 4820 regsvr32.exe 82 PID 4820 wrote to memory of 3288 4820 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\12b26c5685c100b7647b1f2802f6505e_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\12b26c5685c100b7647b1f2802f6505e_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3288
-