Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe
-
Size
124KB
-
MD5
3b80d58650078c92bcb5c7e524350ea7
-
SHA1
b20e6a795d41d9454c714b76b446cb45bf58ddae
-
SHA256
4d8b1635216fdda1b97aacd31f8274e794914a526b5b1d448ba996636407ac12
-
SHA512
63eb0978960b44eb13f349e724acfc3e1197c7780fb1c8e433e71aebbefe096b82c2ff57119aa75e285b7e57269f6ba16b36fa18bf3907ec9ac238ad6aeb6942
-
SSDEEP
1536:KJtkj7TQZU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VeRPNeG0h/y:AkjAZU0GgAT9QIq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cuuiho.exe -
Executes dropped EXE 1 IoCs
pid Process 2696 cuuiho.exe -
Loads dropped DLL 2 IoCs
pid Process 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /b" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /Z" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /j" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /C" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /r" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /N" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /P" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /i" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /a" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /J" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /X" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /V" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /F" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /q" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /O" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /Q" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /p" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /G" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /A" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /n" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /c" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /f" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /U" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /M" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /E" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /x" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /v" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /t" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /T" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /y" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /z" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /e" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /u" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /h" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /D" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /L" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /k" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /g" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /W" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /B" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /R" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /o" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /s" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /H" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /m" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /Y" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /S" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /I" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /E" 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /w" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /K" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /d" cuuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuuiho = "C:\\Users\\Admin\\cuuiho.exe /l" cuuiho.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe 2696 cuuiho.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 2696 cuuiho.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2696 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 29 PID 2588 wrote to memory of 2696 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 29 PID 2588 wrote to memory of 2696 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 29 PID 2588 wrote to memory of 2696 2588 3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b80d58650078c92bcb5c7e524350ea7_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\cuuiho.exe"C:\Users\Admin\cuuiho.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5386ecfdb73b3072369797ac3074a3e6e
SHA1466ad899642ecf799dd1633d1a73e05eda660149
SHA256ae6cbaa9d007da6545ecc3bd3116c9443524bb8400205beb60ba593be863ee99
SHA512c7e77a70631e004e17f975060d80ed34e80ac38d643c27c66c459078edd65aaa6bc49b3e2d7cf922c2a6123dd2637824e7280c0e0c0aa0dcb874d3633bc1a561