Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 05:27
Behavioral task
behavioral1
Sample
37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe
-
Size
3.5MB
-
MD5
37ddfb7305b3244d4c4db0676134fd06
-
SHA1
70b1ddd7d4b098d651a2ba6c07e8d0834b82c45b
-
SHA256
f51652b3c16d5b11a8f601d7e3604839292c811e4a11d761a32259278f66d004
-
SHA512
806cc165121777d35341aa946401517652212115ce48b2e26c290fe645ffda946c37123873d9a1c3a36fc752e7e0999c65d193c0bedd6242a12a9723967841c9
-
SSDEEP
98304:sAKDPUTGHXoXe79PUgyLq9Nf4yvH5dNu6lF+:QP4G3oa9PXJ9Nf465dU6S
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2668 notepad.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine explorer.exe -
resource yara_rule behavioral1/memory/2800-0-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-2-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-3-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-4-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-6-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-5-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-8-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-7-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-37-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-39-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-40-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-42-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-64-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2800-47-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-46-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-66-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-67-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-68-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-79-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-81-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-80-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-78-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-77-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-76-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-75-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-74-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-73-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-72-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-71-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-70-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-69-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral1/memory/2676-117-0x0000000013140000-0x00000000139E5000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2800 set thread context of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSecurityPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSystemtimePrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeBackupPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeRestorePrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeShutdownPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeDebugPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeUndockPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeManageVolumePrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeImpersonatePrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 33 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 34 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 35 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2124 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 30 PID 2800 wrote to memory of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 PID 2800 wrote to memory of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 PID 2800 wrote to memory of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 PID 2800 wrote to memory of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 PID 2800 wrote to memory of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 PID 2800 wrote to memory of 2676 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 31 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32 PID 2800 wrote to memory of 2668 2800 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
PID:2124
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Identifies Wine through registry keys
PID:2676
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵
- Deletes itself
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1