Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 10:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe
-
Size
9KB
-
MD5
1af26413d37c7767795ee2873ea0f345
-
SHA1
edee7304b740a1602498a6a5b96923a5f1681176
-
SHA256
fc8adb303987f97bf1ab7beb7c57cca1be5407abe0220a6346a0779dbfcb5e2f
-
SHA512
2700bc003c4dcd51d8a62c764237bd5dd064e9a4344cd11573fd3c3993d74ebca3e90ce6ae622f28c97a624412b9b63649f2fe9a0930909d7586f984d5ca5d7d
-
SSDEEP
192:fASGZU4eNHatyPkPmcC5wSvcMpBeya1bhclSLu+1Ad8bEEkneUiokERl+:fAjUdz6sw9Mvathclh+1Q8bEEkBg
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d7a6ff672c0fbdc9de0fa86d7667c811bd2c20d1b5379cd80fc7c47e8817625d000000000e800000000200002000000023add3964dd5487db1243b74775679d29774f5104e3239157832abdc80b5a0fb200000005576ceca02b9832f525077ca7fd43eccd85d12b9d2e8be6ef4eef745109681f84000000077d74a42645b389b263293abbea7b75c7eaf0509e952e7f5985514215b5913ce0c234c86e29fc9fd5a2bf525ac924e56abce584e1473756202775e689f5882f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03ecfbda1cbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8371A01-3794-11EF-91CF-DEECE6B0C1A4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425991679" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000bc66167919f67ccba9b3ff2c74b4f324f7625b6d5d593f9b06153108123eda49000000000e8000000002000020000000c4e30b1021b5930b31f85c7ff22e03116849dcb376ca4cf236d09bbf24b6d3f5900000009aa7ee730fc4e270c74ebade1a5ec8502092c40a32e8fb9431ffcd4b02adb771d5f60f214beff75d5c1557e71edf142194f4358a2d2f78b98c3c543442bb950905748e2c90d209299dfed3b1285965f9838fcefbb473bb0ad1ddf46e55bd8279e59b2378fddc8b4feb44ec9436e1a58aa477eb219f51166ac117eae602b78424549271330afe790f97ebb944339b21674000000059e7691a4547afb109635e494f1deed10f08fafcdfcc4c081422dc3f2de515a0e10d1da8532e678ce04e641161877a38e1299a50edd8ba5c4289474e99a920f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 2360 iexplore.exe 2360 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2976 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2976 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2976 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2976 2116 1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe 28 PID 2976 wrote to memory of 1288 2976 cmd.exe 31 PID 2976 wrote to memory of 1288 2976 cmd.exe 31 PID 2976 wrote to memory of 1288 2976 cmd.exe 31 PID 2976 wrote to memory of 1288 2976 cmd.exe 31 PID 1288 wrote to memory of 2704 1288 net.exe 32 PID 1288 wrote to memory of 2704 1288 net.exe 32 PID 1288 wrote to memory of 2704 1288 net.exe 32 PID 1288 wrote to memory of 2704 1288 net.exe 32 PID 2360 wrote to memory of 2736 2360 iexplore.exe 33 PID 2360 wrote to memory of 2736 2360 iexplore.exe 33 PID 2360 wrote to memory of 2736 2360 iexplore.exe 33 PID 2360 wrote to memory of 2736 2360 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1af26413d37c7767795ee2873ea0f345_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c net stop sharedaccess2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:2704
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-