Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 15:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe
-
Size
204KB
-
MD5
0758e3a1dfb3d1d721042e0a8e62373a
-
SHA1
3f93743af81d1cfebd1f23ae967dd20dcef1b2e6
-
SHA256
9865fb72c203a823d2d865818335826396452dec506cfacda66ed0f61dbc0731
-
SHA512
250ba87489f71d2b21ea929a145c2345858a49cfff65fee502e64b34f0237f00c1e864aa5a9733517cd6f47798b81510b93535f0e58d670fc0bf6054d9a091e7
-
SSDEEP
3072:mmRW8oeM0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWoG:BANeM4QxL7B9W0c1RCzR/fSmljG
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noejai.exe -
Executes dropped EXE 1 IoCs
pid Process 2920 noejai.exe -
Loads dropped DLL 2 IoCs
pid Process 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /r" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /j" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /f" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /w" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /t" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /h" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /p" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /e" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /l" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /b" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /n" 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /q" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /s" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /z" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /a" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /o" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /u" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /m" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /k" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /i" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /v" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /x" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /c" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /g" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /d" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /n" noejai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\noejai = "C:\\Users\\Admin\\noejai.exe /y" noejai.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe 2920 noejai.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 2920 noejai.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2920 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 28 PID 2484 wrote to memory of 2920 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 28 PID 2484 wrote to memory of 2920 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 28 PID 2484 wrote to memory of 2920 2484 0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0758e3a1dfb3d1d721042e0a8e62373a_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\noejai.exe"C:\Users\Admin\noejai.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD534958a0c30fc20dcfba6a2ca24a0ff17
SHA162fff22d3e4fb1970968db6d7b5e4e6bcd6ef4d1
SHA25617cf1b65c67e3d658c7f96a30f0eff172aedc2b765943a446d093d95f3ae21b4
SHA512237134dd77a0f3c5aae1b12be893acc1fd2ab443101bdd380bba718899612ff122a9de28ad01848f46165566b555f4c21bb084084a034442199341beece45b41