Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 22:31
Static task
static1
Behavioral task
behavioral1
Sample
267773fdad7ae1984bfc052fb653903d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
267773fdad7ae1984bfc052fb653903d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
267773fdad7ae1984bfc052fb653903d_JaffaCakes118.dll
-
Size
60KB
-
MD5
267773fdad7ae1984bfc052fb653903d
-
SHA1
b6c5bf1bafd819405282680b110832ef90e245eb
-
SHA256
b0808e2245fc5fb4fb12056f711729df27d9a01faa276894928af2580b8d9e37
-
SHA512
1b6dc400338f7aeeb11082a54d6d4a8d694230ed68c88e4e23c4142592c6b30823bf37d055b4f3ba1941114d88b82203dfce7691932f5635c0dd82feb375c215
-
SSDEEP
1536:bQhWdNgUP4/3ZiWY+6V1NLCBT8bjltWOjdZ7:ngPZY+Q0ubptWO5N
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Windows Share = "RunDll32 \"C:\\Windows\\logetsrv.dll\",Init" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\GroupPolicy\hostsrv.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\hostsrv.dll rundll32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\logetsrv.dll rundll32.exe File opened for modification C:\Windows\logetsrv.dll rundll32.exe File created C:\Windows\L2Schemas\msperf.dll rundll32.exe File opened for modification C:\Windows\L2Schemas\msperf.dll rundll32.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh rundll32.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh rundll32.exe -
Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController rundll32.exe Key created \REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter rundll32.exe Key created \REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0 rundll32.exe Key created \REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController rundll32.exe Key created \REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral rundll32.exe Key created \REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier rundll32.exe Key created \REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter rundll32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 2536 wrote to memory of 1748 2536 rundll32.exe 30 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1064 1748 rundll32.exe 18 PID 1748 wrote to memory of 1064 1748 rundll32.exe 18 PID 1748 wrote to memory of 1132 1748 rundll32.exe 19 PID 1748 wrote to memory of 1132 1748 rundll32.exe 19 PID 1748 wrote to memory of 1200 1748 rundll32.exe 21 PID 1748 wrote to memory of 1200 1748 rundll32.exe 21 PID 1748 wrote to memory of 1232 1748 rundll32.exe 25 PID 1748 wrote to memory of 1232 1748 rundll32.exe 25 PID 1748 wrote to memory of 2536 1748 rundll32.exe 29 PID 1748 wrote to memory of 2536 1748 rundll32.exe 29 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31 PID 1748 wrote to memory of 1524 1748 rundll32.exe 31
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1064
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1132
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\267773fdad7ae1984bfc052fb653903d_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\267773fdad7ae1984bfc052fb653903d_JaffaCakes118.dll,#13⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Event Triggered Execution: Netsh Helper DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\RunDll32.exeRunDll32 "C:\Users\Admin\AppData\Local\Temp\267773fdad7ae1984bfc052fb653903d_JaffaCakes118.dll",Init4⤵PID:1524
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1232
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5267773fdad7ae1984bfc052fb653903d
SHA1b6c5bf1bafd819405282680b110832ef90e245eb
SHA256b0808e2245fc5fb4fb12056f711729df27d9a01faa276894928af2580b8d9e37
SHA5121b6dc400338f7aeeb11082a54d6d4a8d694230ed68c88e4e23c4142592c6b30823bf37d055b4f3ba1941114d88b82203dfce7691932f5635c0dd82feb375c215