Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 13:57
Behavioral task
behavioral1
Sample
6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe
-
Size
60KB
-
MD5
6fdc949f9df9b1f96b6becb5028c3065
-
SHA1
4868e9c88788f489dfec0ba7cc035141bdbb94fc
-
SHA256
cdb5727eaec08f98f3eae94cc3df88b92bb97d2079a44466b61cd4d632d6172a
-
SHA512
3b84c4f470e3693192493e1b336f12e4d5d959236bbf5b61972b2d312031f367db4e6e541bd06db95f7102136afd36183c66e90322e7208682e8745986aab80c
-
SSDEEP
1536:Ux8XWoln1KWVwIKCCFDeKaJstZHlyZu3OdeVAl6Is:Uxgl0rOCpHaJaZHlv3OqENs
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2372-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2372-6-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\desktop.ini 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.exe 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.exe 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2972 2372 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.chm 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ini\DefaultIcon\ = "D:\\Downloads\\system.exe,0" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\Shell\Open\Command 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\Shell\Open\Command\ = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\system.exe\" \"%1\"" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\DefaultIcon 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ = "url|chm" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\Shell 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.chm\ = "url|chm" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ini\ 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\ini\EditFlags = "2" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open\Command 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ini\DefaultIcon 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open\Command\ = "\"D:\\Downloads\\system.exe\" \"%1\"" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ini 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\ 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\EditFlags = "2" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\Shell\Open 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\url|chm\DefaultIcon\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\system.exe,0" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ini 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "ini" 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.url 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe -
Runs .reg file with regedit 2 IoCs
pid Process 2744 regedit.exe 2756 regedit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe Token: SeDebugPrivilege 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2744 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2744 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2744 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2744 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2756 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 32 PID 2372 wrote to memory of 2756 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 32 PID 2372 wrote to memory of 2756 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 32 PID 2372 wrote to memory of 2756 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 32 PID 2372 wrote to memory of 2972 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 33 PID 2372 wrote to memory of 2972 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 33 PID 2372 wrote to memory of 2972 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 33 PID 2372 wrote to memory of 2972 2372 6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fdc949f9df9b1f96b6becb5028c3065_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\1.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2744
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\2.reg2⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 3282⤵
- Program crash
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5e532a7a5500ac88686f2652774d20cad
SHA1c66cf1e777652669db90e7b41edc789b91f9bc6f
SHA2562cbcd42cde6691a33857e2511ec64daffa3896a1260bcdae088d7b4a34c45bbd
SHA51260b6f0d4b7f1a4ce082855258f97939bbaec4e52f0340e2b10ca587ebf6715b5402cb37f160b8a98734875fc3a7fb2f51148a39e047daa01deb47f5539fdcd07
-
Filesize
670B
MD5fe7497d77714bc0841d55d07da45d12d
SHA1b45ca6abe83f887248e61df81b8f8dfe49ba146d
SHA256c1178ead6d2aba64f24ba246b6aeeacd366101a91ec706a1563144050c9e6f77
SHA5129d59076bd0cfd483e6d973c43df95efb8a9bd0d7e58a7ab18b75df7bd1c2aaf85b9bff45b60d151420c2716314d81178333ed33b7400c38e22141e91d18e6e6c