Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 09:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe
-
Size
360KB
-
MD5
25830caee95d594b6d437d8ac3b84f10
-
SHA1
260a6dd4b44662c2da6fe5e0650a3561f6f13a04
-
SHA256
453da6955c691ed6adb47715e129a11f3b2f6dea826d4c815ae42fdfaa14db36
-
SHA512
eec5877fb6aab513bd3f001c0955bf0c68b1f34cf655cc8dc0be96e6b2bce496c126e0a3d473ae5b4a347810536a942c068c22ec0290616ca62a5b1071bb7e83
-
SSDEEP
6144:B8xwFE5KW6gjcdSW1vrG5qD1JTHReDMZT:BHzDdSyi5e5Rw
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 1884 ttc.exe -
Executes dropped EXE 1 IoCs
pid Process 1884 ttc.exe -
Loads dropped DLL 2 IoCs
pid Process 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\Content Type = "application/x-msdownload" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas\command ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open\command ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start\command ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\ = "Application" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\DefaultIcon ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ttc.exe\" -a \"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\DefaultIcon\ = "%1" ttc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\2811986575 = "C:\\Users\\Admin\\AppData\\Local\\ttc.exe" ttc.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ttc.exe\" -a \"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\start ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\ = "Application" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\DefaultIcon\ = "%1" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\open\command ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open\command ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas\command ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\runas ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\start\command ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\ = "exefile" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\DefaultIcon ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\runas\command ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start\command ttc.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\DefaultIcon ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\Content Type = "application/x-msdownload" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\Content Type = "application/x-msdownload" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.exe\shell\open ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\DefaultIcon\ = "%1" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ttc.exe\" -a \"%1\" %*" ttc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" ttc.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\exefile\shell\start ttc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 1884 ttc.exe 1884 ttc.exe 1884 ttc.exe 1884 ttc.exe 1884 ttc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2760 explorer.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 1884 ttc.exe 1884 ttc.exe 1884 ttc.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 1884 ttc.exe 2760 explorer.exe 2760 explorer.exe 1884 ttc.exe 2760 explorer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 1884 ttc.exe 1884 ttc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1884 ttc.exe 1884 ttc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1884 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 28 PID 2188 wrote to memory of 1884 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 28 PID 2188 wrote to memory of 1884 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 28 PID 2188 wrote to memory of 1884 2188 25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe 28 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\ttc.exe"C:\Users\Admin\AppData\Local\ttc.exe" -gav C:\Users\Admin\AppData\Local\Temp\25830caee95d594b6d437d8ac3b84f10_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD525830caee95d594b6d437d8ac3b84f10
SHA1260a6dd4b44662c2da6fe5e0650a3561f6f13a04
SHA256453da6955c691ed6adb47715e129a11f3b2f6dea826d4c815ae42fdfaa14db36
SHA512eec5877fb6aab513bd3f001c0955bf0c68b1f34cf655cc8dc0be96e6b2bce496c126e0a3d473ae5b4a347810536a942c068c22ec0290616ca62a5b1071bb7e83