Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 18:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe
-
Size
316KB
-
MD5
1701f09f7348b0a609b8819b076bb4df
-
SHA1
946adb3857d1478e9a26387b83efaf86ca217245
-
SHA256
6c5f89452d664c01acbf9264bc18c58e45ed6ff54ee58afeda8e39680dfb4c65
-
SHA512
2b1793a1292718892dc882603a375ee284e8b72be12c7cd9df541e5e0d9f6b42ee8c960aef01efe2e836d7313a53680aedb53844a9315613b36922831faa4b72
-
SSDEEP
6144:k/JVYO/QyCTEtWff9nQMdkxIV0OQotoBOm8ntGUcF6/DsEfNXqkEL:mJVYO/09YxIToYmtyIx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" muobo.exe -
Executes dropped EXE 1 IoCs
pid Process 1768 muobo.exe -
Loads dropped DLL 2 IoCs
pid Process 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /L" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /h" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /q" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /V" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /w" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /R" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /f" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /S" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /Y" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /D" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /s" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /X" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /P" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /t" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /l" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /r" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /v" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /G" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /u" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /b" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /J" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /C" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /Z" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /x" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /E" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /a" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /g" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /o" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /d" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /p" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /U" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /K" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /N" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /A" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /F" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /K" 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /i" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /m" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /B" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /e" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /M" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /y" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /c" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /T" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /j" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /k" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /W" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /O" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /z" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /Q" muobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\muobo = "C:\\Users\\Admin\\muobo.exe /n" muobo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe 1768 muobo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 1768 muobo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1768 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 28 PID 2412 wrote to memory of 1768 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 28 PID 2412 wrote to memory of 1768 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 28 PID 2412 wrote to memory of 1768 2412 1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1701f09f7348b0a609b8819b076bb4df_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\muobo.exe"C:\Users\Admin\muobo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5f238138cbc6a7db66ff95651f83af536
SHA1924b0fd090390678b753562e23e32f6b3af6e593
SHA2564dcd9a338d70f70ee5c3ab701853f285e8c0dc882cff4552024138967b5df49a
SHA51201e88c48ed6671180d3e65d9afa102e8012938b71e157d9d6d651a763d08027079d2cb863c7d61033d65e0264ba0d87f8eacd6e5754a4df5d716c02e122a2052