Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe
-
Size
947KB
-
MD5
44e31dcd5609d3be0ee013c951c4932c
-
SHA1
a2cf6bdaf388919809e8e728633f439c382f56cc
-
SHA256
a406864b7b1c4df4cdfd95b23acfc75abe3326c8bc1e0426a16de366cf8f6c5f
-
SHA512
2b1d440412e233c3c7f0b6546545dc4ae70c55991185f95fc0c9f5de1f220d00b840d31812be5914a988550208c39d4498928c6ec661b5fda3f6750115b13e46
-
SSDEEP
12288:j8+PrL2x/ECm1pRm5D2yKW4ueSFP8/BIXxuuYNJ8cQbt:LZ1Hmp2TW4ueSFP86XxuuYNicQ
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\GF3XW8MP00.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF3XW8MP00.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 1 IoCs
pid Process 2504 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2304 set thread context of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2688 reg.exe 2632 reg.exe 2744 reg.exe 2628 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe Token: 1 2504 svchost.exe Token: SeCreateTokenPrivilege 2504 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2504 svchost.exe Token: SeLockMemoryPrivilege 2504 svchost.exe Token: SeIncreaseQuotaPrivilege 2504 svchost.exe Token: SeMachineAccountPrivilege 2504 svchost.exe Token: SeTcbPrivilege 2504 svchost.exe Token: SeSecurityPrivilege 2504 svchost.exe Token: SeTakeOwnershipPrivilege 2504 svchost.exe Token: SeLoadDriverPrivilege 2504 svchost.exe Token: SeSystemProfilePrivilege 2504 svchost.exe Token: SeSystemtimePrivilege 2504 svchost.exe Token: SeProfSingleProcessPrivilege 2504 svchost.exe Token: SeIncBasePriorityPrivilege 2504 svchost.exe Token: SeCreatePagefilePrivilege 2504 svchost.exe Token: SeCreatePermanentPrivilege 2504 svchost.exe Token: SeBackupPrivilege 2504 svchost.exe Token: SeRestorePrivilege 2504 svchost.exe Token: SeShutdownPrivilege 2504 svchost.exe Token: SeDebugPrivilege 2504 svchost.exe Token: SeAuditPrivilege 2504 svchost.exe Token: SeSystemEnvironmentPrivilege 2504 svchost.exe Token: SeChangeNotifyPrivilege 2504 svchost.exe Token: SeRemoteShutdownPrivilege 2504 svchost.exe Token: SeUndockPrivilege 2504 svchost.exe Token: SeSyncAgentPrivilege 2504 svchost.exe Token: SeEnableDelegationPrivilege 2504 svchost.exe Token: SeManageVolumePrivilege 2504 svchost.exe Token: SeImpersonatePrivilege 2504 svchost.exe Token: SeCreateGlobalPrivilege 2504 svchost.exe Token: 31 2504 svchost.exe Token: 32 2504 svchost.exe Token: 33 2504 svchost.exe Token: 34 2504 svchost.exe Token: 35 2504 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2504 svchost.exe 2504 svchost.exe 2504 svchost.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2504 2304 44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe 29 PID 2504 wrote to memory of 2896 2504 svchost.exe 30 PID 2504 wrote to memory of 2896 2504 svchost.exe 30 PID 2504 wrote to memory of 2896 2504 svchost.exe 30 PID 2504 wrote to memory of 2896 2504 svchost.exe 30 PID 2504 wrote to memory of 2764 2504 svchost.exe 31 PID 2504 wrote to memory of 2764 2504 svchost.exe 31 PID 2504 wrote to memory of 2764 2504 svchost.exe 31 PID 2504 wrote to memory of 2764 2504 svchost.exe 31 PID 2504 wrote to memory of 2884 2504 svchost.exe 33 PID 2504 wrote to memory of 2884 2504 svchost.exe 33 PID 2504 wrote to memory of 2884 2504 svchost.exe 33 PID 2504 wrote to memory of 2884 2504 svchost.exe 33 PID 2504 wrote to memory of 2748 2504 svchost.exe 34 PID 2504 wrote to memory of 2748 2504 svchost.exe 34 PID 2504 wrote to memory of 2748 2504 svchost.exe 34 PID 2504 wrote to memory of 2748 2504 svchost.exe 34 PID 2748 wrote to memory of 2688 2748 cmd.exe 38 PID 2748 wrote to memory of 2688 2748 cmd.exe 38 PID 2748 wrote to memory of 2688 2748 cmd.exe 38 PID 2748 wrote to memory of 2688 2748 cmd.exe 38 PID 2764 wrote to memory of 2744 2764 cmd.exe 39 PID 2764 wrote to memory of 2744 2764 cmd.exe 39 PID 2764 wrote to memory of 2744 2764 cmd.exe 39 PID 2764 wrote to memory of 2744 2764 cmd.exe 39 PID 2896 wrote to memory of 2632 2896 cmd.exe 40 PID 2896 wrote to memory of 2632 2896 cmd.exe 40 PID 2896 wrote to memory of 2632 2896 cmd.exe 40 PID 2896 wrote to memory of 2632 2896 cmd.exe 40 PID 2884 wrote to memory of 2628 2884 cmd.exe 41 PID 2884 wrote to memory of 2628 2884 cmd.exe 41 PID 2884 wrote to memory of 2628 2884 cmd.exe 41 PID 2884 wrote to memory of 2628 2884 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44e31dcd5609d3be0ee013c951c4932c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2744
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2628
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\GF3XW8MP00.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GF3XW8MP00.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\GF3XW8MP00.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\GF3XW8MP00.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98