Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe
-
Size
124KB
-
MD5
42d70e497677df40c6d2e506db979fee
-
SHA1
c72c06b23e3a5a08b1b5d724ab17cb29a7541ea7
-
SHA256
72a705d351211e9ec40f79105cb63b1e85aa74ee41027f6b1120d606610e1986
-
SHA512
10c637bb9f0df951a744ddc36aa5c3409f61929af88fe9f7c9fd7fec19f16e639fc1dfccbf540cf44067e45c8976da94d93af9460af5e3b08152afe7e0126c0d
-
SSDEEP
1536:lLEf4wRVuBxLDtVdHa27J14lWxporZ45iMNeG0h/y:1Ef4wRVkLt6gJ1uPt45eq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" veiadec.exe -
Executes dropped EXE 1 IoCs
pid Process 3024 veiadec.exe -
Loads dropped DLL 2 IoCs
pid Process 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /K" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /u" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /F" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /q" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /J" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /Y" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /z" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /I" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /a" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /X" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /s" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /e" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /o" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /Z" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /N" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /b" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /y" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /h" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /c" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /V" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /r" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /v" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /f" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /S" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /W" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /B" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /w" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /i" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /D" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /t" 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /l" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /M" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /O" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /t" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /E" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /U" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /L" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /n" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /Q" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /A" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /T" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /P" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /j" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /k" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /R" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /d" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /g" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /p" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /C" veiadec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\veiadec = "C:\\Users\\Admin\\veiadec.exe /x" veiadec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe 3024 veiadec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 3024 veiadec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3024 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 30 PID 2376 wrote to memory of 3024 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 30 PID 2376 wrote to memory of 3024 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 30 PID 2376 wrote to memory of 3024 2376 42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42d70e497677df40c6d2e506db979fee_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\veiadec.exe"C:\Users\Admin\veiadec.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD57e1b59d6430725db9c9c91fefa28c3be
SHA1bb0ac4f1e7d09e18dec42bf84959a359bd16e77a
SHA2561045a90f803c12efca0e47eafffb905fcf15a7581e348b9e59ab410ab146541b
SHA512672ee354b5817707245f1dd48ebdf6ecffddb18f3d4fa0c81abd3418ef500ae38b3936c9478aaa617d30ebe1fe646b3faed9e624529bfc6bafac1762af9edf46