Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe
-
Size
140KB
-
MD5
0f94ca18b66a6bc523da99b52b47c947
-
SHA1
64e31c5ac914e6d1bb4df57cd2bc33f9ed088c4f
-
SHA256
824d5e30a658d3a67d2377e7f97bc33811f7680ce950cc602d5f7cd6a4c76ae5
-
SHA512
e7c69e97c57d351451e3d5073c0a720524839235f96a983cc70f62624005b2ace0b9e179ddc68730e91ab627a582b47f2823f11e04a55f4ac101e3458f2207d7
-
SSDEEP
3072:tY2TEm50QYyAXBYeNgn6gb0kYp8OyDn8+rkP+7x8Dzve:tJTEOPYywBYeUpb0kYp8OyDn8+rkP+7l
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" delog.exe -
Executes dropped EXE 1 IoCs
pid Process 2212 delog.exe -
Loads dropped DLL 2 IoCs
pid Process 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /y" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /d" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /l" 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /C" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /S" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /u" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /l" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /n" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /W" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /H" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /G" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /p" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /B" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /s" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /g" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /t" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /K" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /r" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /Q" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /V" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /h" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /T" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /M" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /o" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /Y" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /i" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /X" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /P" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /b" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /R" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /I" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /f" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /e" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /A" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /k" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /w" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /D" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /E" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /J" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /v" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /x" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /z" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /c" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /F" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /m" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /U" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /j" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /N" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /q" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /Z" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /a" delog.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\delog = "C:\\Users\\Admin\\delog.exe /L" delog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe 2212 delog.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 2212 delog.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2212 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 28 PID 2512 wrote to memory of 2212 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 28 PID 2512 wrote to memory of 2212 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 28 PID 2512 wrote to memory of 2212 2512 0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f94ca18b66a6bc523da99b52b47c947_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\delog.exe"C:\Users\Admin\delog.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD518a1487fb9a0dbc2e3b104eb36e415ce
SHA1d8210eda0c6b37b543f94daac7d384daa1b34617
SHA256d5f353413e93f24f40c0f9250fe183ee634c4513509e843ef4b5fcb9e5e176de
SHA512dc12f3490b8f4a3388a62f4ae7df337fb67444607939b144936020ce8082371cb0489f5044b1d0a9de4fb1ebe55ce8ebc3abbe6324e3db267befe63823b585e3