Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe
-
Size
127KB
-
MD5
e2c610a8dc66be4914ef40cc90fd26c1
-
SHA1
4ff62851b7e7b101c7e63e5fd63312f7a4baba23
-
SHA256
c065e85103fef84d4c006b7c564871c4b998d87e3e3a5537eb3fd3de1ebdd9cc
-
SHA512
bab0fcebd69387a4a50d07747e8f3d4e2e3e438eb89d428c6aaef1eaa4b9ad148279bab1483d89cfde3887da287bf90b260895c604da54f0acb5d9c6114cd8ff
-
SSDEEP
3072:U09K6zz00dhADwdZxn7z1itdQ8GyzBcIG274bZhzQmeCrg34bfkg:xBdP/As8GyzBT4Zhjecg3UM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2576 trivax1.Bin.exe -
Loads dropped DLL 2 IoCs
pid Process 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2072-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2576-23-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2072-69-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\trivax1.Bin.exe = "C:\\trivax1.Bin\\trivax1.Bin.exe" trivax1.Bin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" trivax1.Bin.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" trivax1.Bin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" trivax1.Bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe 2576 trivax1.Bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe Token: SeDebugPrivilege 2576 trivax1.Bin.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1180 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 21 PID 2072 wrote to memory of 388 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 3 PID 2072 wrote to memory of 436 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 5 PID 2072 wrote to memory of 492 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 7 PID 2072 wrote to memory of 500 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 8 PID 2072 wrote to memory of 596 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 9 PID 2072 wrote to memory of 680 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 10 PID 2072 wrote to memory of 744 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 11 PID 2072 wrote to memory of 812 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 12 PID 2072 wrote to memory of 856 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 13 PID 2072 wrote to memory of 960 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 15 PID 2072 wrote to memory of 280 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 16 PID 2072 wrote to memory of 1044 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 17 PID 2072 wrote to memory of 1052 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 18 PID 2072 wrote to memory of 1104 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 19 PID 2072 wrote to memory of 1136 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 20 PID 2072 wrote to memory of 1180 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 21 PID 2072 wrote to memory of 320 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 23 PID 2072 wrote to memory of 2148 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 24 PID 2072 wrote to memory of 2244 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 25 PID 2072 wrote to memory of 2576 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 28 PID 2072 wrote to memory of 2576 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 28 PID 2072 wrote to memory of 2576 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 28 PID 2072 wrote to memory of 2576 2072 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 28 PID 2576 wrote to memory of 1180 2576 trivax1.Bin.exe 21 PID 2576 wrote to memory of 388 2576 trivax1.Bin.exe 3 PID 2576 wrote to memory of 436 2576 trivax1.Bin.exe 5 PID 2576 wrote to memory of 492 2576 trivax1.Bin.exe 7 PID 2576 wrote to memory of 500 2576 trivax1.Bin.exe 8 PID 2576 wrote to memory of 596 2576 trivax1.Bin.exe 9 PID 2576 wrote to memory of 680 2576 trivax1.Bin.exe 10 PID 2576 wrote to memory of 744 2576 trivax1.Bin.exe 11 PID 2576 wrote to memory of 812 2576 trivax1.Bin.exe 12 PID 2576 wrote to memory of 856 2576 trivax1.Bin.exe 13 PID 2576 wrote to memory of 960 2576 trivax1.Bin.exe 15 PID 2576 wrote to memory of 280 2576 trivax1.Bin.exe 16 PID 2576 wrote to memory of 1044 2576 trivax1.Bin.exe 17 PID 2576 wrote to memory of 1052 2576 trivax1.Bin.exe 18 PID 2576 wrote to memory of 1104 2576 trivax1.Bin.exe 19 PID 2576 wrote to memory of 1136 2576 trivax1.Bin.exe 20 PID 2576 wrote to memory of 1180 2576 trivax1.Bin.exe 21 PID 2576 wrote to memory of 320 2576 trivax1.Bin.exe 23 PID 2576 wrote to memory of 2148 2576 trivax1.Bin.exe 24 PID 2576 wrote to memory of 2244 2576 trivax1.Bin.exe 25 PID 2576 wrote to memory of 2072 2576 trivax1.Bin.exe 27 PID 2576 wrote to memory of 1888 2576 trivax1.Bin.exe 29 PID 2576 wrote to memory of 536 2576 trivax1.Bin.exe 30 PID 2576 wrote to memory of 1148 2576 trivax1.Bin.exe 31 PID 2576 wrote to memory of 940 2576 trivax1.Bin.exe 32 PID 2576 wrote to memory of 2572 2576 trivax1.Bin.exe 33
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:388
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:320
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:1888
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵PID:1148
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:940
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:2572
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"2⤵PID:1104
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:856
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:536
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:280
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1044
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1136
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\trivax1.Bin\trivax1.Bin.exe"C:\trivax1.Bin\trivax1.Bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:2148
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD596f4ed1e6523ea5fd57e457fe8e12977
SHA19c48d689c0d46dd4b30f3441715a384014993be2
SHA2563e017d7f2bcc0fa41a28f1403d006ab19e46c209b276151c0e53ebda7fe50f64
SHA51251f9c662f29090a940a6d231e8bf607f43368f73e415edc3138b2ae5f47ab7fb8c96f460e0c822549923c33077c2794aa01586941cecf0f2be739f096a351a08
-
Filesize
127KB
MD5e2c610a8dc66be4914ef40cc90fd26c1
SHA14ff62851b7e7b101c7e63e5fd63312f7a4baba23
SHA256c065e85103fef84d4c006b7c564871c4b998d87e3e3a5537eb3fd3de1ebdd9cc
SHA512bab0fcebd69387a4a50d07747e8f3d4e2e3e438eb89d428c6aaef1eaa4b9ad148279bab1483d89cfde3887da287bf90b260895c604da54f0acb5d9c6114cd8ff