Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 10:52
Static task
static1
Behavioral task
behavioral1
Sample
4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe
-
Size
342KB
-
MD5
4161c566499b1d7696a88c6a6e07037e
-
SHA1
3c7cde2749c167961a5ebf59b22365b6747e7dd6
-
SHA256
7860ffb00e221c28feb60b6ce0f03b045b08eb6ecd8a2d6b6ea727224d5d8c5f
-
SHA512
dc24f3b68d9ba459454221d8995bac9fb69230030f9eb159cdfbd6324930749de7b6a43d81618ca1203415760c27018802a54e2e0162833d51bf9dafe4bac593
-
SSDEEP
6144:KYKzwLcbGbJXAq4nu+fCknc3/cmYQ8CzRicvJy81BEQVyboS1y1TvC:WwQbS5Aqujqk6c1KjvJyE6Q0oS1S6
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146944" Pvnfo9B0c77W9w.exe -
resource yara_rule behavioral1/memory/2512-1-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/1228-4-0x0000000000400000-0x00000000004D6000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\PROGRA~3\Pvnfo9B0c77W9w Pvnfo9B0c77W9w.exe File created C:\PROGRA~3\Pvnfo9B0c77W9w Pvnfo9B0c77W9w.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main Pvnfo9B0c77W9w.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" Pvnfo9B0c77W9w.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1228 Pvnfo9B0c77W9w.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2512 4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1228 Pvnfo9B0c77W9w.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2512 4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe 1228 Pvnfo9B0c77W9w.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1228 2512 4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe 30 PID 2512 wrote to memory of 1228 2512 4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe 30 PID 2512 wrote to memory of 1228 2512 4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe 30 PID 2512 wrote to memory of 1228 2512 4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4161c566499b1d7696a88c6a6e07037e_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\PROGRA~3\Pvnfo9B0c77W9w.exeC:\PROGRA~3\Pvnfo9B0c77W9w.exe2⤵
- Manipulates Digital Signatures
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1228
-