Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe
-
Size
360KB
-
MD5
5df1299e3ec4334e6cdbd4ec6d8dd95e
-
SHA1
62c57fd0bc22b6658295f8443e614a5037bd8a85
-
SHA256
fee509415318dfb14c02c63b9217849f8183fc18206ef09a274ecba0a3e2e26a
-
SHA512
a9793e425b821160a3be60b6dab7a3808fdb067c5753cf1d81d5ca3bf5e94a92fc3fa0266964debf4f3902f7848ad4029c2ab0d3afc94c49c09506f78da843a3
-
SSDEEP
6144:Lu5kkfL1dbFTlWyOHa5ZLhQJi2SDFrWJ/UYHUZoucgnOnE0T:i5kqFT0DHy9hQJi2SiUZozgnA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2740 nrw.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 nrw.exe -
Loads dropped DLL 2 IoCs
pid Process 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\Content Type = "application/x-msdownload" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start\command nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas\command nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\DefaultIcon nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\DefaultIcon\ = "%1" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\nrw.exe\" -a \"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\ = "Application" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open\command nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" nrw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" nrw.exe -
Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\DefaultIcon nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start\command nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\DefaultIcon nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\DefaultIcon\ = "%1" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\start nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\ = "Application" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\ = "exefile" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\DefaultIcon\ = "%1" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\Content Type = "application/x-msdownload" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\nrw.exe\" -a \"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas\command nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open\command nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas\command nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" nrw.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\start\command nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\nrw.exe\" -a \"%1\" %*" nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe nrw.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open\command nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" nrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\exefile\Content Type = "application/x-msdownload" nrw.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 2740 nrw.exe 2740 nrw.exe 2740 nrw.exe 2740 nrw.exe 2740 nrw.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1892 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe Token: SeShutdownPrivilege 1892 explorer.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 2740 nrw.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 2740 nrw.exe 1892 explorer.exe 1892 explorer.exe 2740 nrw.exe 2740 nrw.exe 1892 explorer.exe -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 2740 nrw.exe 2740 nrw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2740 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2740 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2740 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2740 2128 5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\nrw.exe"C:\Users\Admin\AppData\Local\nrw.exe" -gav C:\Users\Admin\AppData\Local\Temp\5df1299e3ec4334e6cdbd4ec6d8dd95e_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2740
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1892
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD55df1299e3ec4334e6cdbd4ec6d8dd95e
SHA162c57fd0bc22b6658295f8443e614a5037bd8a85
SHA256fee509415318dfb14c02c63b9217849f8183fc18206ef09a274ecba0a3e2e26a
SHA512a9793e425b821160a3be60b6dab7a3808fdb067c5753cf1d81d5ca3bf5e94a92fc3fa0266964debf4f3902f7848ad4029c2ab0d3afc94c49c09506f78da843a3