Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
367ca5b03d61725c0d88ae4e7e340611_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
367ca5b03d61725c0d88ae4e7e340611_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
367ca5b03d61725c0d88ae4e7e340611_JaffaCakes118.dll
-
Size
12KB
-
MD5
367ca5b03d61725c0d88ae4e7e340611
-
SHA1
ab621d31f54100f9c516299ef6217dbb17561fec
-
SHA256
118cdf73d1a1f4ddeaecabc4f83669551600c6fed9ef53acc106108700459ba9
-
SHA512
53f42cd8a8b840d9add29ed3f5609d77f76f46f3be1aab9b168b66115bb341784a0d1caaa7aa755540afb8719127b4c34dfda9bc32ca9c80cd2342140d640ca4
-
SSDEEP
384:6+iiK3Zy0MRZTR5i/ofmY6i22pKCVEIDXefA:NK3Zy0L/QU2TmIDZ
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msosmnsf00.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\msosmnsf00.dll rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5040 rundll32.exe 5040 rundll32.exe 5040 rundll32.exe 5040 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5040 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4392 wrote to memory of 5040 4392 rundll32.exe 82 PID 4392 wrote to memory of 5040 4392 rundll32.exe 82 PID 4392 wrote to memory of 5040 4392 rundll32.exe 82 PID 5040 wrote to memory of 612 5040 rundll32.exe 5 PID 5040 wrote to memory of 672 5040 rundll32.exe 7 PID 5040 wrote to memory of 780 5040 rundll32.exe 8 PID 5040 wrote to memory of 812 5040 rundll32.exe 9 PID 5040 wrote to memory of 820 5040 rundll32.exe 10 PID 5040 wrote to memory of 900 5040 rundll32.exe 11 PID 5040 wrote to memory of 960 5040 rundll32.exe 12 PID 5040 wrote to memory of 376 5040 rundll32.exe 13 PID 5040 wrote to memory of 740 5040 rundll32.exe 14 PID 5040 wrote to memory of 1028 5040 rundll32.exe 15 PID 5040 wrote to memory of 1068 5040 rundll32.exe 16 PID 5040 wrote to memory of 1092 5040 rundll32.exe 17 PID 5040 wrote to memory of 1112 5040 rundll32.exe 18 PID 5040 wrote to memory of 1172 5040 rundll32.exe 19 PID 5040 wrote to memory of 1224 5040 rundll32.exe 20 PID 5040 wrote to memory of 1240 5040 rundll32.exe 21 PID 5040 wrote to memory of 1312 5040 rundll32.exe 22 PID 5040 wrote to memory of 1356 5040 rundll32.exe 23 PID 5040 wrote to memory of 1472 5040 rundll32.exe 24 PID 5040 wrote to memory of 1496 5040 rundll32.exe 25 PID 5040 wrote to memory of 1508 5040 rundll32.exe 26 PID 5040 wrote to memory of 1520 5040 rundll32.exe 27 PID 5040 wrote to memory of 1664 5040 rundll32.exe 28 PID 5040 wrote to memory of 1696 5040 rundll32.exe 29 PID 5040 wrote to memory of 1740 5040 rundll32.exe 30 PID 5040 wrote to memory of 1796 5040 rundll32.exe 31 PID 5040 wrote to memory of 1816 5040 rundll32.exe 32 PID 5040 wrote to memory of 1956 5040 rundll32.exe 33 PID 5040 wrote to memory of 1968 5040 rundll32.exe 34 PID 5040 wrote to memory of 1424 5040 rundll32.exe 35 PID 5040 wrote to memory of 1760 5040 rundll32.exe 36 PID 5040 wrote to memory of 1912 5040 rundll32.exe 37 PID 5040 wrote to memory of 2092 5040 rundll32.exe 38 PID 5040 wrote to memory of 2176 5040 rundll32.exe 39 PID 5040 wrote to memory of 2224 5040 rundll32.exe 40 PID 5040 wrote to memory of 2300 5040 rundll32.exe 41 PID 5040 wrote to memory of 2472 5040 rundll32.exe 42 PID 5040 wrote to memory of 2480 5040 rundll32.exe 43 PID 5040 wrote to memory of 2656 5040 rundll32.exe 44 PID 5040 wrote to memory of 2680 5040 rundll32.exe 45 PID 5040 wrote to memory of 2780 5040 rundll32.exe 46 PID 5040 wrote to memory of 2820 5040 rundll32.exe 47 PID 5040 wrote to memory of 2832 5040 rundll32.exe 48 PID 5040 wrote to memory of 2872 5040 rundll32.exe 49 PID 5040 wrote to memory of 2880 5040 rundll32.exe 50 PID 5040 wrote to memory of 2892 5040 rundll32.exe 51 PID 5040 wrote to memory of 2100 5040 rundll32.exe 52 PID 5040 wrote to memory of 3104 5040 rundll32.exe 53 PID 5040 wrote to memory of 3448 5040 rundll32.exe 55 PID 5040 wrote to memory of 3468 5040 rundll32.exe 56 PID 5040 wrote to memory of 3652 5040 rundll32.exe 57 PID 5040 wrote to memory of 3840 5040 rundll32.exe 58 PID 5040 wrote to memory of 3932 5040 rundll32.exe 59 PID 5040 wrote to memory of 4004 5040 rundll32.exe 60 PID 5040 wrote to memory of 4092 5040 rundll32.exe 61 PID 5040 wrote to memory of 428 5040 rundll32.exe 62 PID 5040 wrote to memory of 3916 5040 rundll32.exe 65 PID 5040 wrote to memory of 4320 5040 rundll32.exe 66 PID 5040 wrote to memory of 4836 5040 rundll32.exe 67 PID 5040 wrote to memory of 5112 5040 rundll32.exe 68 PID 5040 wrote to memory of 528 5040 rundll32.exe 69
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:820
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:376
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:780
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3104
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3840
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3932
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4004
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4092
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:428
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3916
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:2020
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:4048
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1552
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:1588
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:856
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider2⤵PID:4728
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1172
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2820
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:4552
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1472
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2656
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1664
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1796
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1968
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:1912
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2176
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2224
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2780
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2100
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\367ca5b03d61725c0d88ae4e7e340611_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\367ca5b03d61725c0d88ae4e7e340611_JaffaCakes118.dll,#13⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3652
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4836
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:5112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4252
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:5100