Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
708abe50048782def5929bc281362498_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
708abe50048782def5929bc281362498_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
708abe50048782def5929bc281362498_JaffaCakes118.exe
-
Size
77KB
-
MD5
708abe50048782def5929bc281362498
-
SHA1
a4bd6a219d317efe3274d84a3f5ea40b84b4ace1
-
SHA256
3f4f2cf6a2844efece2286897dd5e8feda908b6377f8d6bb25bd8fac84e13e00
-
SHA512
4e13c6ddfb213486efac01e1c14a1ece20eda2552c0af02a81ce452231d0089bab5c086509593e70c49cbd69d95fe82d8aadce5f8c6817fd8c48c940ad9d427c
-
SSDEEP
1536:8ujlHwdwzY9FPcVH5P4Zq/Dnr47HrHaL:txm+H5PR/DU7eL
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
pid Process 2804 Rundll32.exe 2804 Rundll32.exe 2804 Rundll32.exe 2804 Rundll32.exe 1960 Rundll32.exe 1960 Rundll32.exe 1960 Rundll32.exe 1960 Rundll32.exe 1960 Rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe" Rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mkbcvctb.dll 708abe50048782def5929bc281362498_JaffaCakes118.exe File created C:\Windows\SysWOW64\befcvctb.dll 708abe50048782def5929bc281362498_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\RAV\CDriver.sys Rundll32.exe File opened for modification C:\Program Files\RAV\CDriver.Inf Rundll32.exe -
Launches sc.exe 23 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2036 sc.exe 2332 sc.exe 596 sc.exe 2364 sc.exe 2712 sc.exe 552 sc.exe 2524 sc.exe 2988 sc.exe 2972 sc.exe 952 sc.exe 2668 sc.exe 2624 sc.exe 2764 sc.exe 2760 sc.exe 1096 sc.exe 1332 sc.exe 264 sc.exe 2888 sc.exe 848 sc.exe 2844 sc.exe 2144 sc.exe 2632 sc.exe 1128 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708abe50048782def5929bc281362498_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2804 Rundll32.exe 2804 Rundll32.exe 2804 Rundll32.exe 1960 Rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2804 Rundll32.exe Token: SeRestorePrivilege 2804 Rundll32.exe Token: SeRestorePrivilege 2804 Rundll32.exe Token: SeRestorePrivilege 2804 Rundll32.exe Token: SeRestorePrivilege 2804 Rundll32.exe Token: SeRestorePrivilege 2804 Rundll32.exe Token: SeRestorePrivilege 2804 Rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2808 wrote to memory of 2804 2808 708abe50048782def5929bc281362498_JaffaCakes118.exe 30 PID 2804 wrote to memory of 2364 2804 Rundll32.exe 31 PID 2804 wrote to memory of 2364 2804 Rundll32.exe 31 PID 2804 wrote to memory of 2364 2804 Rundll32.exe 31 PID 2804 wrote to memory of 2364 2804 Rundll32.exe 31 PID 2804 wrote to memory of 2888 2804 Rundll32.exe 32 PID 2804 wrote to memory of 2888 2804 Rundll32.exe 32 PID 2804 wrote to memory of 2888 2804 Rundll32.exe 32 PID 2804 wrote to memory of 2888 2804 Rundll32.exe 32 PID 2804 wrote to memory of 2712 2804 Rundll32.exe 34 PID 2804 wrote to memory of 2712 2804 Rundll32.exe 34 PID 2804 wrote to memory of 2712 2804 Rundll32.exe 34 PID 2804 wrote to memory of 2712 2804 Rundll32.exe 34 PID 2804 wrote to memory of 2844 2804 Rundll32.exe 35 PID 2804 wrote to memory of 2844 2804 Rundll32.exe 35 PID 2804 wrote to memory of 2844 2804 Rundll32.exe 35 PID 2804 wrote to memory of 2844 2804 Rundll32.exe 35 PID 2804 wrote to memory of 2988 2804 Rundll32.exe 37 PID 2804 wrote to memory of 2988 2804 Rundll32.exe 37 PID 2804 wrote to memory of 2988 2804 Rundll32.exe 37 PID 2804 wrote to memory of 2988 2804 Rundll32.exe 37 PID 2804 wrote to memory of 2760 2804 Rundll32.exe 40 PID 2804 wrote to memory of 2760 2804 Rundll32.exe 40 PID 2804 wrote to memory of 2760 2804 Rundll32.exe 40 PID 2804 wrote to memory of 2760 2804 Rundll32.exe 40 PID 2804 wrote to memory of 2764 2804 Rundll32.exe 41 PID 2804 wrote to memory of 2764 2804 Rundll32.exe 41 PID 2804 wrote to memory of 2764 2804 Rundll32.exe 41 PID 2804 wrote to memory of 2764 2804 Rundll32.exe 41 PID 2804 wrote to memory of 2036 2804 Rundll32.exe 43 PID 2804 wrote to memory of 2036 2804 Rundll32.exe 43 PID 2804 wrote to memory of 2036 2804 Rundll32.exe 43 PID 2804 wrote to memory of 2036 2804 Rundll32.exe 43 PID 2804 wrote to memory of 2624 2804 Rundll32.exe 46 PID 2804 wrote to memory of 2624 2804 Rundll32.exe 46 PID 2804 wrote to memory of 2624 2804 Rundll32.exe 46 PID 2804 wrote to memory of 2624 2804 Rundll32.exe 46 PID 2804 wrote to memory of 2668 2804 Rundll32.exe 48 PID 2804 wrote to memory of 2668 2804 Rundll32.exe 48 PID 2804 wrote to memory of 2668 2804 Rundll32.exe 48 PID 2804 wrote to memory of 2668 2804 Rundll32.exe 48 PID 2804 wrote to memory of 952 2804 Rundll32.exe 49 PID 2804 wrote to memory of 952 2804 Rundll32.exe 49 PID 2804 wrote to memory of 952 2804 Rundll32.exe 49 PID 2804 wrote to memory of 952 2804 Rundll32.exe 49 PID 2804 wrote to memory of 848 2804 Rundll32.exe 50 PID 2804 wrote to memory of 848 2804 Rundll32.exe 50 PID 2804 wrote to memory of 848 2804 Rundll32.exe 50 PID 2804 wrote to memory of 848 2804 Rundll32.exe 50 PID 2804 wrote to memory of 596 2804 Rundll32.exe 53 PID 2804 wrote to memory of 596 2804 Rundll32.exe 53 PID 2804 wrote to memory of 596 2804 Rundll32.exe 53 PID 2804 wrote to memory of 596 2804 Rundll32.exe 53 PID 2804 wrote to memory of 264 2804 Rundll32.exe 54 PID 2804 wrote to memory of 264 2804 Rundll32.exe 54 PID 2804 wrote to memory of 264 2804 Rundll32.exe 54 PID 2804 wrote to memory of 264 2804 Rundll32.exe 54 PID 2804 wrote to memory of 1332 2804 Rundll32.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\708abe50048782def5929bc281362498_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\708abe50048782def5929bc281362498_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\mkbcvctb.dll Execute2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\sc.exesc stop ZhuDongFangYu3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2364
-
-
C:\Windows\SysWOW64\sc.exesc delete ZhuDongFangYu3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\SysWOW64\sc.exesc stop 360rp3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Windows\SysWOW64\sc.exesc delete 360rp3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2844
-
-
C:\Windows\SysWOW64\sc.exesc stop RsRavMon3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2988
-
-
C:\Windows\SysWOW64\sc.exesc delete RsRavMon3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\sc.exesc stop McNASvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\sc.exesc delete McNASvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\Windows\SysWOW64\sc.exesc stop MpfService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2624
-
-
C:\Windows\SysWOW64\sc.exesc delete MpfService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2668
-
-
C:\Windows\SysWOW64\sc.exesc stop McProxy3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:952
-
-
C:\Windows\SysWOW64\sc.exesc delete McProxy3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:848
-
-
C:\Windows\SysWOW64\sc.exesc stop McShield3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:596
-
-
C:\Windows\SysWOW64\sc.exesc delete McShield3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:264
-
-
C:\Windows\SysWOW64\sc.exesc stop McODS3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1332
-
-
C:\Windows\SysWOW64\sc.exesc delete McODS3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1096
-
-
C:\Windows\SysWOW64\sc.exesc stop mcmscsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2972
-
-
C:\Windows\SysWOW64\sc.exesc delete mcmscsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:552
-
-
C:\Windows\SysWOW64\sc.exesc stop McSysmon3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2332
-
-
C:\Windows\SysWOW64\sc.exesc delete McSysmon3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2632
-
-
C:\Windows\SysWOW64\sc.exesc stop ekrn3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2144
-
-
C:\Windows\SysWOW64\sc.exesc delete ekrn3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2524
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1128
-
-
-
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\befcvctb.dll Execute2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d49e24aaddb6de1d7e04f353197fe210
SHA1439cd17010d7af7acfdae45e83cea09f338a67dc
SHA256660bd04c6abdfd1b385abf4a0c79f9eef1007aa2fcd6f7e53b31a3145a062045
SHA5124079b2afdfd2076ce6931640de70617fc27bcf26d09846de80ff238c312504959a117761f7ccb52ad38914d2392bbac0ac7d3bb8981d55e8d663e00e492a5146
-
Filesize
26KB
MD5d4e567f4e233ab037c7dc12c924ee5d6
SHA1c9af7da5c7bae85e248f1f80db5d82dc2f3af6d3
SHA256e59a90649bf2c03712aa1cf08c93b50a683e05802465672f2f351765e3fd1556
SHA512ce6e35aa54d428a71746f6a4c38b78273208e0658e1377384c3d5e330c80780dd6770a85dcbf49fc4c08b4f8fbf2933b66b3daa2698c939381ffeb83d9ef2883
-
Filesize
1.7MB
MD5b5eb5bd3066959611e1f7a80fd6cc172
SHA16fb1532059212c840737b3f923a9c0b152c0887a
SHA2561ffb68a66f28f604adcae9c135f8dcf301316ab7fda8ebd294583c56dd26f7cc
SHA5126c0743e0ff4922e859ba66b68040ab994dbae33e80c63ce8c993ad31a0c7aad6c6467484da1550063214953cd641dbf597438dd0c02f24164505d88ca80ea1b6