Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
a267b914101f369e45a543f833309699_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a267b914101f369e45a543f833309699_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
a267b914101f369e45a543f833309699_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
a267b914101f369e45a543f833309699
-
SHA1
a348e843d9f31b1e8da2dd37a14beec69689b90e
-
SHA256
e9b2b2232c51bf0cd0e251132002e594bd2eb1fb92d10f8dd6dcddbb8eae3893
-
SHA512
6ab67c151c1a99973878c9218dd42a5b2a5b0e30a0b5c359616816a7e54b25ebf96bbcff589f0162440d2c142c501b3d7562a662bde991409bec09a3a73d12b7
-
SSDEEP
49152:9W3IDPx6lY6kWIaWu3neUZFQPWDvG96iv:9bMlY6kWfr3neUZOPWDo6iv
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\LookThisUp = "\"C:\\Users\\Admin\\AppData\\Roaming\\LookThisUp\\a267b914101f369e45a543f833309699_JaffaCakes118.exe\"" a267b914101f369e45a543f833309699_JaffaCakes118.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a267b914101f369e45a543f833309699_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D003860F002ED829DEAA41868F788186D62127F a267b914101f369e45a543f833309699_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D003860F002ED829DEAA41868F788186D62127F\Blob = 0f0000000100000014000000ef4b92510cf5214f96c19fe5dac82fe416b1167b090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b0601050508020253000000010000004800000030463021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c00b000000010000003800000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300200049006e0063002e000000140000000100000014000000b4c67f1a43cc9b755d2fc44bf28b9810e9f151101d0000000100000010000000b260d734a0ca2356e0899d1f624cb0c30300000001000000140000005d003860f002ed829deaa41868f788186d62127f2000000001000000820400003082047e30820366a003020102020100300d06092a864886f70d01010505003081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479301e170d3038303630323030303030305a170d3239313233313233353935395a3081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f2cc562a4de616375a97ea6d3538d1109bdbb8dca9040995332e09c5007b1a78428fc8f4058efed268831e4e99cd17db473e50f389d2e7dc98fb05f8aad663f4544dc17103b01f1b76b31a343073f128326083fdb49cd7b6d222377c19aa3bde1310696e5c06d36fa3f2665a764248af80d154593dd4b9d4dbedb9ab3999f4ee62abe178727bd8388d40b6ccdc120070438569d818e3ca57729fb4df3ffc22a84252f5775b99f0562d2670163612c2279e57a67cd023f179dca3935828383d9fad3643ee37fbf8f943adc856f294125e42eb73b8130dcba6d586b9aa286a5403a13f0f29eb0900e83f5ea27f173da12bf8bed0751da484e3ab1765065200afb10203010001a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b4c67f1a43cc9b755d2fc44bf28b9810e9f15110301f0603551d23041830168014b4c67f1a43cc9b755d2fc44bf28b9810e9f15110300d06092a864886f70d01010505000382010100ac80bbc425050b58a4e47e297eafbc3bec2dc0442ef991e0d23b3227902df680095cc2ab6524da381046c449d2fd9aab28487788c6e96fd14791d5354f1409a85b40071d7c7156cb8942d4bf61c022f72edfabf372438b40e894ebb026dad113d3abd0362d2e3a95b3772e1539180c69baaa80edf1534e339b6804e2a0302ed7d15dd4a6669d84e6e7bb3c89bb369dfc17a93d552b8afb9bc44c84ffdfd2be691b74b0a8f6eab09cb22974814c683a9a7f732539f513e0669169d4574bb7eead45e02cc388d3be9449891fff70d55b6d3913b01dcb98e667630d63f6fbc3d7617283883f707e53c99e8954d64f7f7d71b9aef1608b7760ecf8bffa6aa39c0122 a267b914101f369e45a543f833309699_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D003860F002ED829DEAA41868F788186D62127F\Blob = 190000000100000010000000bcc89a8d6bbded735c4bb4c5cdbb4c3c0300000001000000140000005d003860f002ed829deaa41868f788186d62127f1d0000000100000010000000b260d734a0ca2356e0899d1f624cb0c3140000000100000014000000b4c67f1a43cc9b755d2fc44bf28b9810e9f151100b000000010000003800000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300200049006e0063002e00000053000000010000004800000030463021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f0000000100000014000000ef4b92510cf5214f96c19fe5dac82fe416b1167b2000000001000000820400003082047e30820366a003020102020100300d06092a864886f70d01010505003081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479301e170d3038303630323030303030305a170d3239313233313233353935395a3081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f2cc562a4de616375a97ea6d3538d1109bdbb8dca9040995332e09c5007b1a78428fc8f4058efed268831e4e99cd17db473e50f389d2e7dc98fb05f8aad663f4544dc17103b01f1b76b31a343073f128326083fdb49cd7b6d222377c19aa3bde1310696e5c06d36fa3f2665a764248af80d154593dd4b9d4dbedb9ab3999f4ee62abe178727bd8388d40b6ccdc120070438569d818e3ca57729fb4df3ffc22a84252f5775b99f0562d2670163612c2279e57a67cd023f179dca3935828383d9fad3643ee37fbf8f943adc856f294125e42eb73b8130dcba6d586b9aa286a5403a13f0f29eb0900e83f5ea27f173da12bf8bed0751da484e3ab1765065200afb10203010001a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b4c67f1a43cc9b755d2fc44bf28b9810e9f15110301f0603551d23041830168014b4c67f1a43cc9b755d2fc44bf28b9810e9f15110300d06092a864886f70d01010505000382010100ac80bbc425050b58a4e47e297eafbc3bec2dc0442ef991e0d23b3227902df680095cc2ab6524da381046c449d2fd9aab28487788c6e96fd14791d5354f1409a85b40071d7c7156cb8942d4bf61c022f72edfabf372438b40e894ebb026dad113d3abd0362d2e3a95b3772e1539180c69baaa80edf1534e339b6804e2a0302ed7d15dd4a6669d84e6e7bb3c89bb369dfc17a93d552b8afb9bc44c84ffdfd2be691b74b0a8f6eab09cb22974814c683a9a7f732539f513e0669169d4574bb7eead45e02cc388d3be9449891fff70d55b6d3913b01dcb98e667630d63f6fbc3d7617283883f707e53c99e8954d64f7f7d71b9aef1608b7760ecf8bffa6aa39c0122 a267b914101f369e45a543f833309699_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5D003860F002ED829DEAA41868F788186D62127F\Blob = 040000000100000010000000cf8f3b62a3caca711ba3e1cb4857351f0f0000000100000014000000ef4b92510cf5214f96c19fe5dac82fe416b1167b090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b0601050508020253000000010000004800000030463021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107180230123010060a2b0601040182373c0101030200c00b000000010000003800000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300200049006e0063002e000000140000000100000014000000b4c67f1a43cc9b755d2fc44bf28b9810e9f151101d0000000100000010000000b260d734a0ca2356e0899d1f624cb0c30300000001000000140000005d003860f002ed829deaa41868f788186d62127f190000000100000010000000bcc89a8d6bbded735c4bb4c5cdbb4c3c2000000001000000820400003082047e30820366a003020102020100300d06092a864886f70d01010505003081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479301e170d3038303630323030303030305a170d3239313233313233353935395a3081cf310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313a3038060355040b1331687474703a2f2f6365727469666963617465732e737461726669656c64746563682e636f6d2f7265706f7369746f72792f313630340603550403132d537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100f2cc562a4de616375a97ea6d3538d1109bdbb8dca9040995332e09c5007b1a78428fc8f4058efed268831e4e99cd17db473e50f389d2e7dc98fb05f8aad663f4544dc17103b01f1b76b31a343073f128326083fdb49cd7b6d222377c19aa3bde1310696e5c06d36fa3f2665a764248af80d154593dd4b9d4dbedb9ab3999f4ee62abe178727bd8388d40b6ccdc120070438569d818e3ca57729fb4df3ffc22a84252f5775b99f0562d2670163612c2279e57a67cd023f179dca3935828383d9fad3643ee37fbf8f943adc856f294125e42eb73b8130dcba6d586b9aa286a5403a13f0f29eb0900e83f5ea27f173da12bf8bed0751da484e3ab1765065200afb10203010001a3633061300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414b4c67f1a43cc9b755d2fc44bf28b9810e9f15110301f0603551d23041830168014b4c67f1a43cc9b755d2fc44bf28b9810e9f15110300d06092a864886f70d01010505000382010100ac80bbc425050b58a4e47e297eafbc3bec2dc0442ef991e0d23b3227902df680095cc2ab6524da381046c449d2fd9aab28487788c6e96fd14791d5354f1409a85b40071d7c7156cb8942d4bf61c022f72edfabf372438b40e894ebb026dad113d3abd0362d2e3a95b3772e1539180c69baaa80edf1534e339b6804e2a0302ed7d15dd4a6669d84e6e7bb3c89bb369dfc17a93d552b8afb9bc44c84ffdfd2be691b74b0a8f6eab09cb22974814c683a9a7f732539f513e0669169d4574bb7eead45e02cc388d3be9449891fff70d55b6d3913b01dcb98e667630d63f6fbc3d7617283883f707e53c99e8954d64f7f7d71b9aef1608b7760ecf8bffa6aa39c0122 a267b914101f369e45a543f833309699_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2392 a267b914101f369e45a543f833309699_JaffaCakes118.exe Token: 33 2392 a267b914101f369e45a543f833309699_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2392 a267b914101f369e45a543f833309699_JaffaCakes118.exe Token: 33 2392 a267b914101f369e45a543f833309699_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2392 a267b914101f369e45a543f833309699_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a267b914101f369e45a543f833309699_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a267b914101f369e45a543f833309699_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5689d98e61514dd9c6b922fa320f6e942
SHA12c02bfced839c8b0727c50d40af187594f4f61af
SHA256a5f71e6580ef56de3cd13ea55c7f8ab5524332975c88b85ee0712a63cf90b850
SHA512274a0cc4d9630b8dc09e45b9b0f1ffb854b2f2cf84ffc71bdc22942fee1d070e6f6b63de6972aaef84d0dec6d0565f21aa34c1776e4d24a0cdc021ba4eec774a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ca399af2920abe95f98ff50392ffb9c3
SHA148080af421ed6e2015172b4bc544359a5b4f6ddc
SHA2561df54e0976f84153f2508eda6733b0903116d1af5beaf6bd13b49ff04df09b88
SHA51295a14809ff8dde167ebdd634b7831fe60d86cd1b0e7c1f5c3d64c37b58dfecd62be7ef426b690d14e7e397c0f134f9a76dc9749e7db3c1f4b8cef6a363e517fb
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b