Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe
-
Size
56KB
-
MD5
3cf230799087ac116b3d5361594b7593
-
SHA1
5f7675a405c7cfa54b41278381ea5e7910df1faa
-
SHA256
2602236c997150500682aa1e05b1e879f46c81ae220a2be8c691ffd9bccf15db
-
SHA512
0fe869a1925de69923e3a740327d6801419dc01e6bdf38d0d0658281a4fd2c77b4ee34b76d9492f768e8aaec87311a6187210d290291f16ce50dd8daa001cd8b
-
SSDEEP
768:HM3tgIxw3mHxemBUMLnmzzQxINFIk2d+1FIkRc7NKecMkNYn6WyzZspG6P8Lx4Ns:HMNoFH7ShdLw00NMyBq6ZxH0P6D555o
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woeogo.exe -
Executes dropped EXE 1 IoCs
pid Process 2848 woeogo.exe -
Loads dropped DLL 2 IoCs
pid Process 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /k" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /b" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /L" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /O" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /s" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /P" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /E" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /z" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /o" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /p" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /A" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /H" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /Z" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /e" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /j" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /l" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /t" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /C" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /D" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /G" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /F" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /V" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /c" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /K" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /x" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /v" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /T" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /J" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /i" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /g" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /B" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /W" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /h" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /r" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /u" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /m" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /X" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /N" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /Y" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /R" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /w" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /d" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /q" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /U" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /Q" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /a" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /y" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /I" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /f" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /S" woeogo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeogo = "C:\\Users\\Admin\\woeogo.exe /n" woeogo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe 2848 woeogo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe 2848 woeogo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2848 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe 30 PID 2320 wrote to memory of 2848 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe 30 PID 2320 wrote to memory of 2848 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe 30 PID 2320 wrote to memory of 2848 2320 3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe 30 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29 PID 2848 wrote to memory of 2320 2848 woeogo.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3cf230799087ac116b3d5361594b7593_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\woeogo.exe"C:\Users\Admin\woeogo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD587ca7f911b1e00cc0370aa4e3535357e
SHA181e5b0c3175d9e7f94dc04852317c86c4d99e6fa
SHA256a75deb13df829da3c10ddd60694cf287e92f995e72bf802433b1e3edd6a85e99
SHA512c0063a0ab306ca11a6417a7628eda008afa35c91f6ca8df2ff8e00f0e3eaaf0aad89d98c03b552f283d876a905f253911877164c293f7201a0a138075c5475c0