Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10JaffaCakes...6a.exe
windows7-x64
3JaffaCakes...6a.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3CCleaner.exe
windows7-x64
7CCleaner.exe
windows10-2004-x64
3Interop.SK...ib.dll
windows7-x64
1Interop.SK...ib.dll
windows10-2004-x64
1Microsoft.mshtml.dll
windows7-x64
1Microsoft.mshtml.dll
windows10-2004-x64
1NAudio.dll
windows7-x64
3NAudio.dll
windows10-2004-x64
3Skype4COM.dll
windows7-x64
3Skype4COM.dll
windows10-2004-x64
3cafw.exe
windows7-x64
7cafw.exe
windows10-2004-x64
3cladgenius.chm
windows7-x64
1cladgenius.chm
windows10-2004-x64
1decaptcher.dll
windows7-x64
3decaptcher.dll
windows10-2004-x64
3fbclient.dll
windows7-x64
3fbclient.dll
windows10-2004-x64
3holfix.exe
windows7-x64
8holfix.exe
windows10-2004-x64
9ibprovider.dll
windows7-x64
3ibprovider.dll
windows10-2004-x64
3Analysis
-
max time kernel
104s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
17/03/2025, 13:54
Behavioral task
behavioral1
Sample
JaffaCakes118_7e45597c96c9ee651ffe86ba5821246a.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
JaffaCakes118_7e45597c96c9ee651ffe86ba5821246a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
CCleaner.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
CCleaner.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Interop.SKYPE4COMLib.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Interop.SKYPE4COMLib.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Microsoft.mshtml.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
Microsoft.mshtml.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
NAudio.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral18
Sample
NAudio.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Skype4COM.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Skype4COM.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
cafw.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
cafw.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
cladgenius.chm
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
cladgenius.chm
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
decaptcher.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
decaptcher.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
fbclient.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
fbclient.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
holfix.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
holfix.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ibprovider.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
ibprovider.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
ibprovider.dll
-
Size
3.1MB
-
MD5
3bca69f43800aed83c069037b8efd9f7
-
SHA1
d6387c347b1614979578c3442ec948e3d69d73d3
-
SHA256
278d40f010c994a458b076d1aa4dec03f3891da394d707a254908a7afabd51b1
-
SHA512
83b81cfc1c2291c0a5478eb600eb3edb15cf2346a3293e9292584f981df11b5ef678962f2b73aa48ebf4a6f59021d5facde0b93565fba0a47c24c3919a7f67bb
-
SSDEEP
49152:TX9oxIdkM+x1VKRANMvTA1wAwspjG/HBFIt/M8xc878qLKXZYemFFU+tEyqhguij:ja1Q/g2MtEs
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Advanced Data Link Page [v3]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID\ = "LCPI.IBProvider.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll,1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ibp regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\WOW6432Node\CLSID regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\flush_log_period = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ibp\ = "LCPI.IBProvider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\ = "Extended Error Service" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version\ = "3.0.0.8628" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLEDB_Services = "4294967295" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command\ = "notepad.exe %1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Data Link Page [v3]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer\ = "LCPI.IBProvider.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID\ = "LCPI.IBProvider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3592 wrote to memory of 3588 3592 regsvr32.exe 85 PID 3592 wrote to memory of 3588 3592 regsvr32.exe 85 PID 3592 wrote to memory of 3588 3592 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3588
-