Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
-
Size
124KB
-
MD5
1ab12ca1fb9180ff8fac937066e843a5
-
SHA1
b01b189363d4c5c25af763abd3b769178ec43abd
-
SHA256
cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768
-
SHA512
804bd6ad7a3084c42ef3ce13f9de270d8e499d7f530c422bb3a6f822571296ee85700ebd8fda78eb5f2b86bebd641d11b430211cf47e02f2a4514202f94649ed
-
SSDEEP
3072:KV4nc90YgA4ZKsup/mnU9xw0W/Pgd+vI14:c4nciYg9nUDq/PE4
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" regedit.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging regedit.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" regedit.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Session Manager Subsystem = "C:\\Windows\\smss.exe" 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Logon Process = "C:\\Windows\\winlogon.exe" 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\disable.reg 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe -
Runs .reg file with regedit 1 IoCs
pid Process 4976 regedit.exe -
Runs net.exe
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4636 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 90 PID 3092 wrote to memory of 4636 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 90 PID 3092 wrote to memory of 4636 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 90 PID 4636 wrote to memory of 1708 4636 net.exe 92 PID 4636 wrote to memory of 1708 4636 net.exe 92 PID 4636 wrote to memory of 1708 4636 net.exe 92 PID 3092 wrote to memory of 4976 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 93 PID 3092 wrote to memory of 4976 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 93 PID 3092 wrote to memory of 4976 3092 1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\net.exenet start mswinlogonprocservice2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start mswinlogonprocservice3⤵PID:1708
-
-
-
C:\Windows\SysWOW64\regedit.exeregedit -s C:\Windows\disable.reg2⤵
- Modifies firewall policy service
- Windows security bypass
- Runs .reg file with regedit
PID:4976
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD595de2ee9e174d0a77debf3280514aed6
SHA16f8909c33161711004142e796f7a4f3eba154af1
SHA256231452b77c342dc4fb3c03c9ae01ae4fb6e118cc9a62b79fe1eab126c7fc8190
SHA5127f815ee0da6aaa41e084e8df773ec45d108a611f0a726eb7746d4fe7012b7b2a245f57d275258968d5d21dc0c30410eab40fb672c6051eccf3e7c3875c325268