Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 12:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe
-
Size
208KB
-
MD5
5bf79f11626abdcd497b19f0c85791a9
-
SHA1
5ddd045e4af8be9570c82346d9cf1c57479da099
-
SHA256
c5edfb23ede975fd9e4dd53c6be133a4850f423e7134ab0e500a20452905a4b0
-
SHA512
9cd31d6ecec409d28fb99cc10e3f9189f380e7d37a2b079c4333f29a147033ea062ef423f6a95c76dba58d94093e6ec85bd40bb4bcfc0cefc2a2f301e99ab341
-
SSDEEP
3072:jDMM1y2DD979aAqvxpDWDhQx9AhHp8NeqxEN1yy8p+uxb/:j5yeoA8pDqQx9AhJSRxiJ8jt/
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beuaf.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 beuaf.exe -
Loads dropped DLL 2 IoCs
pid Process 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /r" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /k" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /l" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /U" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /N" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /o" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /Z" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /M" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /E" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /X" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /J" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /a" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /x" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /w" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /L" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /C" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /i" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /H" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /h" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /Q" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /O" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /p" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /K" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /n" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /g" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /v" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /A" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /R" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /q" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /Y" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /S" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /U" 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /F" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /I" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /D" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /m" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /e" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /W" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /b" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /u" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /t" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /f" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /T" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /V" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /d" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /P" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /j" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /c" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /s" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /G" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /y" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /z" beuaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuaf = "C:\\Users\\Admin\\beuaf.exe /B" beuaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe 3060 beuaf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 3060 beuaf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 3060 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 30 PID 1688 wrote to memory of 3060 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 30 PID 1688 wrote to memory of 3060 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 30 PID 1688 wrote to memory of 3060 1688 5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bf79f11626abdcd497b19f0c85791a9_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\beuaf.exe"C:\Users\Admin\beuaf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5f9308615f306819e6a2f8459aa125cb5
SHA10f18b3aaeb7b2e8cb2ac26e91a9b280670286543
SHA256190481a96f7525efb910bd4c175ead3ae9fd995aace76f6a6bc9d36969483507
SHA51239f54f72209f9cb06a1c0eaf9a9f86de80ce97dd4f46a4c900ebb1feeae92e60c483a5a8ce28640b9a06b9adde7511af457f5098abc8aa15961c6f751f0633da