Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 09:25
Behavioral task
behavioral1
Sample
411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe
-
Size
29KB
-
MD5
411a4a7d91a470f004c1d785320e9753
-
SHA1
75e39c62e04fa6a97ea54794b4d3f9c24cc61ebd
-
SHA256
0b24337084608878194c71a3dbf40a06e457b61fad024dd2fb0bfb6ad571073c
-
SHA512
00f44891cda68af23010349568fb2b59150626a352b9e6cd6a2ee02f78ff25a0afdc2aa18679ed44aa288e980cfd4fdba2e743a58157876094dcd03759875f7f
-
SSDEEP
768:tQbuQRy2UjmUndnlTttxDn+3jiSkjRY6AB7kKfYoJ+ifBEewj:QuQRylaUDTDxDXjy6AB7koYy23
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" upkookuk-ced.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51495642-4849-5154-5149-564248495154} upkookuk-ced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51495642-4849-5154-5149-564248495154}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51495642-4849-5154-5149-564248495154}\IsInstalled = "1" upkookuk-ced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51495642-4849-5154-5149-564248495154}\StubPath = "C:\\Windows\\system32\\ulsepop.exe" upkookuk-ced.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe upkookuk-ced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" upkookuk-ced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\afxoroax.exe" upkookuk-ced.exe -
Executes dropped EXE 2 IoCs
pid Process 4380 upkookuk-ced.exe 1516 upkookuk-ced.exe -
resource yara_rule behavioral2/memory/3264-0-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/files/0x00080000000234b8-5.dat upx behavioral2/memory/4380-13-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/3264-10-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/1516-19-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/4380-53-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/1516-54-0x0000000000400000-0x0000000000417000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" upkookuk-ced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" upkookuk-ced.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\amfineac.dll" upkookuk-ced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" upkookuk-ced.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} upkookuk-ced.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify upkookuk-ced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" upkookuk-ced.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\amfineac.dll upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\amfineac.dll upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\rmass.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\aset32.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\upkookuk-ced.exe 411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe File created C:\Windows\SysWOW64\upkookuk-ced.exe 411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\afxoroax.exe upkookuk-ced.exe File created C:\Windows\SysWOW64\ulsepop.exe upkookuk-ced.exe File created C:\Windows\SysWOW64\afxoroax.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\ulsepop.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll upkookuk-ced.exe File opened for modification C:\Windows\SysWOW64\upkookuk-ced.exe upkookuk-ced.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe upkookuk-ced.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe upkookuk-ced.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 1516 upkookuk-ced.exe 1516 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe 4380 upkookuk-ced.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3264 411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe Token: SeDebugPrivilege 4380 upkookuk-ced.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 4380 3264 411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe 83 PID 3264 wrote to memory of 4380 3264 411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe 83 PID 3264 wrote to memory of 4380 3264 411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe 83 PID 4380 wrote to memory of 616 4380 upkookuk-ced.exe 5 PID 4380 wrote to memory of 1516 4380 upkookuk-ced.exe 84 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 1516 4380 upkookuk-ced.exe 84 PID 4380 wrote to memory of 1516 4380 upkookuk-ced.exe 84 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56 PID 4380 wrote to memory of 3504 4380 upkookuk-ced.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\411a4a7d91a470f004c1d785320e9753_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\upkookuk-ced.exe"C:\Windows\system32\upkookuk-ced.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\upkookuk-ced.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5ae95de5807de829bb0aae8557d0fbeda
SHA1eedd6b828ee91ba2b918718feb02f4e67c6a3710
SHA2565bdab6dfa307bb7f4f50624c3112f489fcdcdeb0851bfb49404c01107713861c
SHA5128c438395a00c33c88cd3b168004e044f0c9fa950265ea0dd8d3635d4df9e853565ff42fd4c95d275f36477befe7e14a8c3ffd9ab50d8e125a271fa30b143f1ed
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
31KB
MD57f7698d00453b4a656dd9d681fd51ec3
SHA165ee46ef4dfd52b67ee500c73cc45aa5ef050825
SHA256fd04ffa37da065d771684e6468a1bcb2bf332bebddbfa8c42ab4229c53e772af
SHA512caecf49d54ef59cfb7f0c2694e89872bb3cde4c5e7c48364f313aae91b9047d1c5458fb6b066f317c81d6722b9957ddc536546abc270c07bc4cbecf2581aee9e
-
Filesize
29KB
MD5411a4a7d91a470f004c1d785320e9753
SHA175e39c62e04fa6a97ea54794b4d3f9c24cc61ebd
SHA2560b24337084608878194c71a3dbf40a06e457b61fad024dd2fb0bfb6ad571073c
SHA51200f44891cda68af23010349568fb2b59150626a352b9e6cd6a2ee02f78ff25a0afdc2aa18679ed44aa288e980cfd4fdba2e743a58157876094dcd03759875f7f