Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Errors
General
-
Target
64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe
-
Size
43KB
-
MD5
64d4e3d136e8a1b8fbbacb2d3fd59979
-
SHA1
79c80a8668b4ce529563b561ff6778c9ab330e27
-
SHA256
2c357310491f6643a133870005248ef8ea4af1734358996e4edf882f17d39158
-
SHA512
fc56d85ea9dca0c115016468867978a4bece667400fdc70f7837f5cb2fbe776730921699c23a3c43f1aa67905713b44c3783cab144edd9b2eacd0152f99d0e15
-
SSDEEP
768:yyBnYLuyuF+C/0SYVHpgvfOpUiHf92ZSEGtpvsT51FwdC/pZPodEeEJ6Len:ycnYLuqcvY9KvGpRMZeQFwdinPydEJ66
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\551132085 = "C:\\Users\\Admin\\551132085.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "155" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe Token: SeShutdownPrivilege 4252 shutdown.exe Token: SeRemoteShutdownPrivilege 4252 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3968 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1712 wrote to memory of 4216 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 84 PID 1712 wrote to memory of 4216 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 84 PID 1712 wrote to memory of 4216 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 84 PID 4216 wrote to memory of 3860 4216 cmd.exe 86 PID 4216 wrote to memory of 3860 4216 cmd.exe 86 PID 4216 wrote to memory of 3860 4216 cmd.exe 86 PID 1712 wrote to memory of 4252 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 88 PID 1712 wrote to memory of 4252 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 88 PID 1712 wrote to memory of 4252 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 88 PID 1712 wrote to memory of 3788 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 90 PID 1712 wrote to memory of 3788 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 90 PID 1712 wrote to memory of 3788 1712 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 551132085 /t REG_SZ /d "%userprofile%\551132085.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 551132085 /t REG_SZ /d "C:\Users\Admin\551132085.exe" /f3⤵
- Adds Run key to start application
PID:3860
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\64D4E3~1.EXE > nul2⤵PID:3788
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b4855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3968