Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 22:27
Behavioral task
behavioral1
Sample
5def5470442105538cfd1da19d27888b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5def5470442105538cfd1da19d27888b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5def5470442105538cfd1da19d27888b_JaffaCakes118.exe
-
Size
91KB
-
MD5
5def5470442105538cfd1da19d27888b
-
SHA1
37bf6e70ca682f3e3d564bcf87c5a9cb348f1c61
-
SHA256
51a76604b7a46c7a548a4b4ba9eb17699afcddd8a14865911fe31950e145e2c6
-
SHA512
ef4d9a0a8e08ad17010236bc92f63fffefcc18634f767f0ab0b3ecca726d62d12e126c355047ae8c5a4d8cb411a77bef88ee20c5864f485650998ec625d645cf
-
SSDEEP
1536:oqF54cS86+sJymu1/I5mxG03oGRhxjlNGMLxZewlnWqyN7dq32eSUNnjeHsLkdJR:QrZcmu1/I5mxG03oGRhxjlNGMLxZewlz
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe -
Modifies Windows Firewall 2 TTPs 6 IoCs
pid Process 2672 netsh.exe 1152 netsh.exe 1716 netsh.exe 3000 netsh.exe 1752 netsh.exe 1684 netsh.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/3032-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/3032-3-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\engel = "C:\\Users\\Admin\\AppData\\Roaming\\updates\\updates.exe" 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\engel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe" 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\DHCP = "1654748" 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\DNS 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3032 wrote to memory of 1752 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1752 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1752 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1752 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1684 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 32 PID 3032 wrote to memory of 1684 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 32 PID 3032 wrote to memory of 1684 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 32 PID 3032 wrote to memory of 1684 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 32 PID 3032 wrote to memory of 2672 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 34 PID 3032 wrote to memory of 2672 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 34 PID 3032 wrote to memory of 2672 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 34 PID 3032 wrote to memory of 2672 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 34 PID 3032 wrote to memory of 1152 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 36 PID 3032 wrote to memory of 1152 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 36 PID 3032 wrote to memory of 1152 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 36 PID 3032 wrote to memory of 1152 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 36 PID 3032 wrote to memory of 1716 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 38 PID 3032 wrote to memory of 1716 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 38 PID 3032 wrote to memory of 1716 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 38 PID 3032 wrote to memory of 1716 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 38 PID 3032 wrote to memory of 3000 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 40 PID 3032 wrote to memory of 3000 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 40 PID 3032 wrote to memory of 3000 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 40 PID 3032 wrote to memory of 3000 3032 5def5470442105538cfd1da19d27888b_JaffaCakes118.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Drops startup file
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="5def5470442105538cfd1da19d27888b_JaffaCakes118" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1752
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="5def5470442105538cfd1da19d27888b_JaffaCakes118" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1684
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="5def5470442105538cfd1da19d27888b_JaffaCakes118" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2672
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="5def5470442105538cfd1da19d27888b_JaffaCakes118" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1152
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="5def5470442105538cfd1da19d27888b_JaffaCakes118" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1716
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="5def5470442105538cfd1da19d27888b_JaffaCakes118" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\5def5470442105538cfd1da19d27888b_JaffaCakes118.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1