Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe
-
Size
536KB
-
MD5
2c36dee52b5569487dfc2ecda8a37973
-
SHA1
135a70de10cad4c248f90b8c07476193f7256329
-
SHA256
1488c871975eb6f742fc9ca0d152fe3cc310feef4d025ad558cc10b70d9b9319
-
SHA512
0d7a8464442d25a7bfbfb7ceb766578a1ad68bae895f8dca457e9aece346f70615f6bc7a2faab899d842b3795f3083b0d32ab1b994f547892e8ae3b726db91e4
-
SSDEEP
12288:nLNcH/Xwu/sro3X5Azmgh1R3/n0aRz6mHGP:nO/wu/p3X5emghH/0wzdHe
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\system32\\1050\\svchost.exe" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3052 svchost.exe -
Loads dropped DLL 4 IoCs
pid Process 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Win64 = "C:\\Windows\\system32\\1050\\svchost.exe" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\1050\svchost.exe 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\1050\svchost.exe 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe File created C:\Windows\SysWOW64\2065\mscomctl.dll 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSINET.ocx 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ijl11.dll 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control, version 6.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ThreadingModel = "Apartment" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\ 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control, version 6.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID\ = "InetCtls.Inet" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 3052 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2816 wrote to memory of 3052 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 83 PID 2816 wrote to memory of 3052 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 83 PID 2816 wrote to memory of 3052 2816 2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c36dee52b5569487dfc2ecda8a37973_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\1050\svchost.exeC:\Windows\system32\1050\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD52c36dee52b5569487dfc2ecda8a37973
SHA1135a70de10cad4c248f90b8c07476193f7256329
SHA2561488c871975eb6f742fc9ca0d152fe3cc310feef4d025ad558cc10b70d9b9319
SHA5120d7a8464442d25a7bfbfb7ceb766578a1ad68bae895f8dca457e9aece346f70615f6bc7a2faab899d842b3795f3083b0d32ab1b994f547892e8ae3b726db91e4
-
Filesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0