Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe
-
Size
68KB
-
MD5
23f6bcc0c3a0946047f2e36256c64ca8
-
SHA1
bac0a6dc201485d9935d786086f618fbdecb92df
-
SHA256
ffffe82884f58422e0ed7b3b6e5bb8fa89c596f20598a022acf53d8ce1609115
-
SHA512
e6eca3ccb158a303b4f30d1b3b09198e263dbc74b7de1c7ad2db95a2dcfc455fabd30c38c856baabe1eb80077d020f84a18ecb32cedc884a5e1aca1aebf8855a
-
SSDEEP
768:x0wRKh1v1TSQSu7xpproW6DLH2X196TjNXHoVCosvrWJGgK9cRU82:xBUpSgr+H2mTjN3uCt82
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1196 winlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe -
Drops autorun.inf file 1 TTPs 52 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\H:\autorun.inf winlogon.exe File opened for modification \??\X:\autorun.inf winlogon.exe File created \??\Z:\autorun.inf winlogon.exe File created \??\E:\autorun.inf winlogon.exe File created \??\M:\autorun.inf winlogon.exe File opened for modification \??\N:\autorun.inf winlogon.exe File created \??\I:\autorun.inf winlogon.exe File opened for modification \??\O:\autorun.inf winlogon.exe File opened for modification \??\R:\autorun.inf winlogon.exe File created \??\X:\autorun.inf winlogon.exe File created C:\autorun.inf winlogon.exe File created \??\J:\autorun.inf winlogon.exe File opened for modification \??\S:\autorun.inf winlogon.exe File opened for modification \??\T:\autorun.inf winlogon.exe File created \??\A:\autorun.inf winlogon.exe File created \??\L:\autorun.inf winlogon.exe File opened for modification \??\L:\autorun.inf winlogon.exe File opened for modification \??\M:\autorun.inf winlogon.exe File created \??\N:\autorun.inf winlogon.exe File created \??\O:\autorun.inf winlogon.exe File opened for modification \??\V:\autorun.inf winlogon.exe File opened for modification \??\K:\autorun.inf winlogon.exe File created \??\V:\autorun.inf winlogon.exe File created \??\Q:\autorun.inf winlogon.exe File opened for modification \??\P:\autorun.inf winlogon.exe File opened for modification \??\W:\autorun.inf winlogon.exe File opened for modification \??\J:\autorun.inf winlogon.exe File created \??\P:\autorun.inf winlogon.exe File created \??\S:\autorun.inf winlogon.exe File opened for modification \??\E:\autorun.inf winlogon.exe File created \??\K:\autorun.inf winlogon.exe File opened for modification \??\A:\autorun.inf winlogon.exe File created \??\W:\autorun.inf winlogon.exe File created \??\Y:\autorun.inf winlogon.exe File opened for modification \??\Y:\autorun.inf winlogon.exe File created F:\autorun.inf winlogon.exe File opened for modification \??\Q:\autorun.inf winlogon.exe File opened for modification \??\U:\autorun.inf winlogon.exe File created \??\T:\autorun.inf winlogon.exe File opened for modification \??\Z:\autorun.inf winlogon.exe File created \??\B:\autorun.inf winlogon.exe File opened for modification C:\autorun.inf winlogon.exe File opened for modification F:\autorun.inf winlogon.exe File opened for modification \??\G:\autorun.inf winlogon.exe File opened for modification \??\I:\autorun.inf winlogon.exe File created \??\R:\autorun.inf winlogon.exe File opened for modification D:\autorun.inf winlogon.exe File created \??\G:\autorun.inf winlogon.exe File created \??\H:\autorun.inf winlogon.exe File created \??\U:\autorun.inf winlogon.exe File opened for modification \??\B:\autorun.inf winlogon.exe File created D:\autorun.inf winlogon.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\cmd.gdi winlogon.exe File opened for modification C:\Windows\cmd.gdi winlogon.exe File created C:\Windows\winlogon.exe 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe File opened for modification C:\Windows\winlogon.exe 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe File created C:\Windows\winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe 1196 winlogon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1196 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 28 PID 2232 wrote to memory of 1196 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 28 PID 2232 wrote to memory of 1196 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 28 PID 2232 wrote to memory of 1196 2232 23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23f6bcc0c3a0946047f2e36256c64ca8_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328B
MD52d3ca9ca2ba436ba9a0068e41c4fbaa9
SHA193c2fba0f13f9b85620d68cd488fcab5a57c9ad1
SHA25639688676ac66b2af0deea2b19d05243742902b5bc55fcc8c081b084a9fc50b1f
SHA5126a5d71493cd8bf1cc5cb2057fcaad1e7440109db544e3f76171a2da271b07b07763938593fcdf26552c1c85b1d56d89346f817f5db4acc7dcb95c9979d8579d6
-
Filesize
68KB
MD523f6bcc0c3a0946047f2e36256c64ca8
SHA1bac0a6dc201485d9935d786086f618fbdecb92df
SHA256ffffe82884f58422e0ed7b3b6e5bb8fa89c596f20598a022acf53d8ce1609115
SHA512e6eca3ccb158a303b4f30d1b3b09198e263dbc74b7de1c7ad2db95a2dcfc455fabd30c38c856baabe1eb80077d020f84a18ecb32cedc884a5e1aca1aebf8855a