Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 10:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe
-
Size
192KB
-
MD5
5ba1d549c86659b2e55b7db04764df9a
-
SHA1
262fd00bd6c0d2482aa8f58a5500e1ca68185872
-
SHA256
ac7ecd7e24484b8e12fbd087f0ebf052f4f623b887e3ccd9cdaadd8819d86731
-
SHA512
eadc7eb2906981c3714e4a97c134f419613f9c8077cd720f02a2928daa79d89e971f7a5d66b4d9944028896e1c017098602e8c9bf89c252aff2920a08f3ad8f3
-
SSDEEP
1536:25Bmd2Or1gtVQeaaaaat031AdQWB5kCFrWszRUOHFlQhzyLBVomtfVBiZHAPDoFf:IOBgnW3kCFrWsF2eLorfMfsFs89x
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vuazoy.exe -
Executes dropped EXE 1 IoCs
pid Process 2920 vuazoy.exe -
Loads dropped DLL 2 IoCs
pid Process 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /k" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /p" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /n" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /i" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /r" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /s" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /h" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /q" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /d" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /w" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /l" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /v" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /m" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /t" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /e" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /u" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /n" 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /j" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /x" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /f" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /a" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /o" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /g" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /z" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /y" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /b" vuazoy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuazoy = "C:\\Users\\Admin\\vuazoy.exe /c" vuazoy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe 2920 vuazoy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 2920 vuazoy.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2920 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2920 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2920 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 31 PID 2784 wrote to memory of 2920 2784 5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ba1d549c86659b2e55b7db04764df9a_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\vuazoy.exe"C:\Users\Admin\vuazoy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD54349a987a13e0416748ae6b301cac670
SHA1b0ee2ab50740f1ce125dc82b592ab6be254f1ed3
SHA256be203220edc10fee14c0fa6ef3f4e314f69f04fc6bc932b47f200eaf3c832bbe
SHA5124aa1452bdf888784329486c2f8060ee3437671e10c967ef6934a88dce7901443dbe5ad843e900cb5578a29eae8a0bfb50836f5c79d53d1f0da4c2bf81861d95b