Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe
-
Size
108KB
-
MD5
3e28207f69c7cbbfe5ac29a666f6bc15
-
SHA1
be2a2cc988d5c134e6f57d0c98a36fa3ffdb6ba8
-
SHA256
06cc3da4a11dff07dc54984cf2d51681153413cd3dd1ee1dda20759bb34f46ed
-
SHA512
a34d72b459e10b2b4a18a6c0eec2b7c2288c332e58b47d9dade34e76d4c1f0395137603d75481aa9401cdc46574289fce798d51bd5c761f2f03a41bf306efa3a
-
SSDEEP
1536:Q5eGYiOaTV+BA5uIpZo/QGoGG8betK4pkSQsVEj:Q5eziO7GSuGGJ0V+Vm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" lsass.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2284 netsh.exe -
Deletes itself 1 IoCs
pid Process 1284 lsass.exe -
Executes dropped EXE 1 IoCs
pid Process 1284 lsass.exe -
Loads dropped DLL 2 IoCs
pid Process 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" lsass.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 1284 lsass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 32 PID 2476 wrote to memory of 1284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 32 PID 2476 wrote to memory of 1284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 32 PID 2476 wrote to memory of 1284 2476 3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" CityScape Enable2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2284
-
-
C:\Users\Admin\AppData\Roaming\lsass.exe/d C:\Users\Admin\AppData\Local\Temp\3e28207f69c7cbbfe5ac29a666f6bc15_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5344cbcd0430af6c0503c769bf0c9015a
SHA1976068c16208b37add7bf72a73e45581e56f7245
SHA25610976bdf927062c94935560bcb52935dd23d87fd61e309031b6e785a3d5dc76a
SHA512069198b6ba2062b8a1a82998b2d6d77f76fbc45c45b63a4d0d3c8116827bd2099b4faf370374516ca43b45f3d3a9ef8209b2a21c2ee5e550596e3813783de854