Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe
-
Size
80KB
-
MD5
31001c0b3294f2c79e837b414f1a2692
-
SHA1
aecc35b151ae805431133ef465537ba05d27a807
-
SHA256
ee8a64bd6a4006e9b567635a4f3bf1bc5f4dbd17db09167a20741965c3a2e01e
-
SHA512
e60559a3525e4631ed735ab401b554da5910ca29fcaa203cb84837cdc38e64eb1352687eb586f10ee2f9b67c97642993f65863e7fd1c8aabc3e296c9bfe31bc4
-
SSDEEP
1536:vvz1Q27x4i3zY/Zv5BlEStr91keFQFxyYj9mPppocy:vvx7G+zoZvNEkrOxyYj9BP
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe -
Loads dropped DLL 24 IoCs
pid Process 1952 svchost.exe 1952 svchost.exe 2356 svchost.exe 2356 svchost.exe 2692 svchost.exe 2692 svchost.exe 2924 svchost.exe 2924 svchost.exe 2572 svchost.exe 2572 svchost.exe 3032 svchost.exe 3032 svchost.exe 1628 svchost.exe 1628 svchost.exe 2444 svchost.exe 2444 svchost.exe 2756 svchost.exe 2756 svchost.exe 2884 svchost.exe 2884 svchost.exe 2864 svchost.exe 2864 svchost.exe 2108 svchost.exe 2108 svchost.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Wmi.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\LogonHours.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1760 31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31001c0b3294f2c79e837b414f1a2692_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:1952
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2356
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2692
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2924
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2572
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:3032
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:1628
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵PID:1000
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2444
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2756
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2884
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2864
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD58e0ec0e8732cc36927f1f3efb2e941b6
SHA1eed568c9b9a491109de09cd58ea257186b5a3d47
SHA256b5e81fd07e16c2032ed8ba259d90ffa6d5ec4e4de792a1f38bd7b1abcdbb52e5
SHA5121cdb57549afcd0890e9622f5b29694f7c7ac11ca902c980ad9375d46b77216ef080c338bb5f91dcc4e121aadc50bb23d3a7bd570d318be091f3fa188600b8c37