Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 05:27
Behavioral task
behavioral1
Sample
37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
General
-
Target
37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe
-
Size
3.5MB
-
MD5
37ddfb7305b3244d4c4db0676134fd06
-
SHA1
70b1ddd7d4b098d651a2ba6c07e8d0834b82c45b
-
SHA256
f51652b3c16d5b11a8f601d7e3604839292c811e4a11d761a32259278f66d004
-
SHA512
806cc165121777d35341aa946401517652212115ce48b2e26c290fe645ffda946c37123873d9a1c3a36fc752e7e0999c65d193c0bedd6242a12a9723967841c9
-
SSDEEP
98304:sAKDPUTGHXoXe79PUgyLq9Nf4yvH5dNu6lF+:QP4G3oa9PXJ9Nf465dU6S
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 672 notepad.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Wine explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Wine 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2456-0-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/2456-2-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/2456-3-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/2456-4-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/2456-9-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/2456-14-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-13-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-18-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-26-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-23-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-19-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-17-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/2456-15-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-28-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-33-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-34-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-35-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-40-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-41-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-39-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-38-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-37-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-36-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-31-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-32-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-30-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-29-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-27-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-25-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-24-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-22-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-21-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-20-0x0000000013140000-0x00000000139E5000-memory.dmp themida behavioral2/memory/1252-43-0x0000000013140000-0x00000000139E5000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2456 set thread context of 1252 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 86 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSecurityPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSystemtimePrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeBackupPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeRestorePrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeShutdownPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeDebugPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeUndockPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeManageVolumePrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeImpersonatePrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 33 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 34 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 35 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe Token: 36 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 4052 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 85 PID 2456 wrote to memory of 1252 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 86 PID 2456 wrote to memory of 1252 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 86 PID 2456 wrote to memory of 1252 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 86 PID 2456 wrote to memory of 1252 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 86 PID 2456 wrote to memory of 1252 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 86 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87 PID 2456 wrote to memory of 672 2456 37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37ddfb7305b3244d4c4db0676134fd06_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
PID:4052
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Identifies Wine through registry keys
PID:1252
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵
- Deletes itself
PID:672
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1