Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe
-
Size
543KB
-
MD5
2cec946711c83f10cd19da625fe9b29b
-
SHA1
5adda6c883a251bb444ba0cc9aafa4998e10e00f
-
SHA256
4ea8de3128a42108f14519c9a24221bd212e6893e1646b05723c4717ac3e6fc4
-
SHA512
cd784186cf158a1cb7f176316939f2aee9d2bbfb293f473dcfa354a86c46cfad90e6c7d58d585b93d31b9e94e945cac92035a5e09ce4942c8600bc69d02cd644
-
SSDEEP
12288:nOI2YpeqiR9mDny7aD44g+QF8GlF3Z4mxxoLeP6MzEUkdjqo:B2Ypl09q0aD44+QmXoCyq2Rqo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 640 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2092 muqiu -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat muqiu -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\muqiu 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe File opened for modification C:\Windows\muqiu 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe File created C:\Windows\Delete.bat 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe -
Modifies data under HKEY_USERS 37 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecisionTime = 10cf179192d1da01 muqiu Key created \REGISTRY\USER\.DEFAULT\System muqiu Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1" muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecisionReason = "1" muqiu Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDetectedUrl muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecisionTime = 10cf179192d1da01 muqiu Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties muqiu Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections muqiu Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecision = "0" muqiu Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\9a-83-8c-be-90-b8 muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecisionReason = "1" muqiu Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" muqiu Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" muqiu Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadNetworkName = "Network 2" muqiu Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm muqiu Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 muqiu Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control muqiu Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecisionTime = 501da46792d1da01 muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 muqiu Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50} muqiu Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8 muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-83-8c-be-90-b8\WpadDecision = "0" muqiu Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix muqiu Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet muqiu Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C2A443A5-C3C8-4240-92AA-A9CD17696C50}\WpadDecisionTime = 501da46792d1da01 muqiu Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" muqiu Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick muqiu Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" muqiu Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" muqiu -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 muqiu -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2252 2092 muqiu 31 PID 2092 wrote to memory of 2252 2092 muqiu 31 PID 2092 wrote to memory of 2252 2092 muqiu 31 PID 2092 wrote to memory of 2252 2092 muqiu 31 PID 1572 wrote to memory of 640 1572 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe 32 PID 1572 wrote to memory of 640 1572 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe 32 PID 1572 wrote to memory of 640 1572 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe 32 PID 1572 wrote to memory of 640 1572 2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2cec946711c83f10cd19da625fe9b29b_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\Delete.bat2⤵
- Deletes itself
PID:640
-
-
C:\Windows\muqiuC:\Windows\muqiu1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:2252
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214B
MD5143874551bc96c84943f98d4000e5f00
SHA11361434eaeec59d8e0d423f6cc9b5031c955afda
SHA25661a815c30cc82f0400d9c52f79b194e5def34136bc83538a1cde7399bd082d79
SHA512fa9fa729b6f3d2f112fe709070d4fd4d364eaca54f86cab09b99e04d3f07df85483e5f3f830becc48e255f13d4a9b68949a97d6c78d8df92382b8fa92b4c357b
-
Filesize
543KB
MD52cec946711c83f10cd19da625fe9b29b
SHA15adda6c883a251bb444ba0cc9aafa4998e10e00f
SHA2564ea8de3128a42108f14519c9a24221bd212e6893e1646b05723c4717ac3e6fc4
SHA512cd784186cf158a1cb7f176316939f2aee9d2bbfb293f473dcfa354a86c46cfad90e6c7d58d585b93d31b9e94e945cac92035a5e09ce4942c8600bc69d02cd644