Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 19:30
Behavioral task
behavioral1
Sample
14a82d0d8cb55f1961271410c40c74a2_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
14a82d0d8cb55f1961271410c40c74a2_JaffaCakes118.dll
-
Size
88KB
-
MD5
14a82d0d8cb55f1961271410c40c74a2
-
SHA1
3a7c158075fcd770859d836a127f87c030f7e55e
-
SHA256
7bc1a6c9ef51390497454813619f4b75291338c195d12074c4596a83cf1afe21
-
SHA512
1f8f59ac3569ea3f50051a49bef9ee33e23dae1628a3827f0571a3a93232315c97fbf3a8c6e983b3b60a40063ed4bbe4a83716dd42e5e24c8ddaec01f3af2490
-
SSDEEP
1536:OrUiGUy5cMwMWTVku/rOyMGadU1w+T/KKgJFbTZASCsPjG7+yr2RwWveG:fixy5cMWVHJE+w+TC/dZA6G7D2S5
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95C29069-3C16-231D-CD10-C009E4F35F84} regsvr32.exe -
resource yara_rule behavioral2/memory/3464-0-0x0000000010000000-0x000000001003D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 42 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\ = "JxlQhpqv Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj\CurVer\ = "JxlQhpqv.IEHlprObj.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14a82d0d8cb55f1961271410c40c74a2_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\ProgID\ = "JxlQhpqv.IEHlprObj.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\VersionIndependentProgID\ = "JxlQhpqv.IEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\ = "IIEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\TypeLib\ = "{95C29068-3C16-231D-CD10-C009E4F35F84}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj\ = "JxlQhpqv Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\ = "JxlQhpqv 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\TypeLib\ = "{95C29068-3C16-231D-CD10-C009E4F35F84}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\ = "IIEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj.1\ = "JxlQhpqv Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95C29069-3C16-231D-CD10-C009E4F35F84}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14A82D~1.DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95C29067-3C16-231D-CD10-C009E4F35F84}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JxlQhpqv.IEHlprObj.1\CLSID\ = "{95C29069-3C16-231D-CD10-C009E4F35F84}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{95C29068-3C16-231D-CD10-C009E4F35F84}\1.0\0\win32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4652 wrote to memory of 3464 4652 regsvr32.exe 82 PID 4652 wrote to memory of 3464 4652 regsvr32.exe 82 PID 4652 wrote to memory of 3464 4652 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14a82d0d8cb55f1961271410c40c74a2_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\14a82d0d8cb55f1961271410c40c74a2_JaffaCakes118.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3464
-