Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
188581acc0e1b6cf98dc543f7710e559
-
SHA1
9e1817701ad3c7d4153ec8738b0acb10a1ff39a6
-
SHA256
05e51ad26382511ff300de11c8e191c25cb585e5319e899dedb6dd57db69e9c4
-
SHA512
510d91ed71b0c6a8f5179dc721b79571cd1fd6c976e59b0b0d09ddbdad55d886c56424f72222a88964f7038e92f4c491b1b5638b2bfab37d25965cf6a0f04f34
-
SSDEEP
24576:KgdX7wIhYuG1d0VW+IsbAgPPlH1FOKoCxXNpm5hptLbeXcnP:t7wN8W+Imx3D4OXNpct9P
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1692 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe 1692 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe 1692 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe 1692 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2536 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe Token: SeShutdownPrivilege 2536 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe 2536 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1692 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe 1692 188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\188581acc0e1b6cf98dc543f7710e559_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1692
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2536