Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe
-
Size
4.9MB
-
MD5
06df0980fff3b950dcf02359b7162ee5
-
SHA1
d2a9de6ae30f40243d941fe747da2f20790b6e62
-
SHA256
0590894e2ef5e46ca7044fec6df83d362021c7a0798aed4aa38baa6e2fe066ed
-
SHA512
46f815717388a4bd273dcae7df9577a37b8089b8bc2a17b087ea7418d24af2a07722072ffbe2374f6a0697780fddf9e5fb360302b1452143b87aba761681f4e8
-
SSDEEP
98304:3Mtb7/SrJkyTl9KMkEfj9gMWRW1xpF27ZOidJf9a52DLsz8RG3slJu+NEOt:QurJR9/JgtWjpF2VtdJ852BceTNvt
Malware Config
Signatures
-
Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winexec32 = "C:\\Documents and Settings\\windhelp32.exe" 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\wscnntfyy.dat 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2760 sc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2680 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2972 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 28 PID 1740 wrote to memory of 2972 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 28 PID 1740 wrote to memory of 2972 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 28 PID 1740 wrote to memory of 2972 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 28 PID 1740 wrote to memory of 2680 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 30 PID 1740 wrote to memory of 2680 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 30 PID 1740 wrote to memory of 2680 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 30 PID 1740 wrote to memory of 2680 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 30 PID 1740 wrote to memory of 2760 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 31 PID 1740 wrote to memory of 2760 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 31 PID 1740 wrote to memory of 2760 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 31 PID 1740 wrote to memory of 2760 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 31 PID 1740 wrote to memory of 2560 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 33 PID 1740 wrote to memory of 2560 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 33 PID 1740 wrote to memory of 2560 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 33 PID 1740 wrote to memory of 2560 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 33 PID 1740 wrote to memory of 2912 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 35 PID 1740 wrote to memory of 2912 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 35 PID 1740 wrote to memory of 2912 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 35 PID 1740 wrote to memory of 2912 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 35 PID 1740 wrote to memory of 2688 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 36 PID 1740 wrote to memory of 2688 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 36 PID 1740 wrote to memory of 2688 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 36 PID 1740 wrote to memory of 2688 1740 06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /TN startt /f2⤵PID:2972
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\sys.bat /sc onstart /ru system2⤵
- Scheduled Task/Job: Scheduled Task
PID:2680
-
-
C:\Windows\SysWOW64\sc.exesc delete GbpSv2⤵
- Launches sc.exe
PID:2760
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2560
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2912
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1