Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
73a7af12fdb9bbc4ace34d92d13713f7_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
73a7af12fdb9bbc4ace34d92d13713f7_JaffaCakes118.dll
-
Size
292KB
-
MD5
73a7af12fdb9bbc4ace34d92d13713f7
-
SHA1
bcb1850f6f5d20715683893b90f264f85ddaf0f7
-
SHA256
006508a54a938b7eee9075ee4b52fb7be22726037ca4fb7306ed2c91f1ce78a3
-
SHA512
dda76a32cede9526348190f04f2c011285ec2a239e0df9e3ad8a9a507ed283ef2551139db26c644e5f73bfae9c9dc4b59dd80d266a239a8cf7c42b1673bd1836
-
SSDEEP
3072:E2UxPvVKNiNz1a2JRC+Tq/Kc1yfxN9A1DeVEBJjRy5agw9r8C:nGvQ4Nx9RHTVXfxNe1aVEJX8C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1632 rundll32mgr.exe 2500 WaterMark.exe -
resource yara_rule behavioral2/memory/1632-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1632-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2500-26-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2500-31-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2500-30-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2500-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2500-41-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/2500-42-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\px902A.tmp rundll32mgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2604 976 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "648827562" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31121222" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{524EB44B-4B39-11EF-A174-F2AA1BA6131E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428754478" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "648671460" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31121222" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{524C516C-4B39-11EF-A174-F2AA1BA6131E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "652578009" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31121222" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31121222" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "652578009" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe 2500 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2500 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3684 iexplore.exe 4376 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3684 iexplore.exe 3684 iexplore.exe 4376 iexplore.exe 4376 iexplore.exe 4076 IEXPLORE.EXE 4076 IEXPLORE.EXE 412 IEXPLORE.EXE 412 IEXPLORE.EXE 4076 IEXPLORE.EXE 4076 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1632 rundll32mgr.exe 2500 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 960 wrote to memory of 1836 960 rundll32.exe 84 PID 960 wrote to memory of 1836 960 rundll32.exe 84 PID 960 wrote to memory of 1836 960 rundll32.exe 84 PID 1836 wrote to memory of 1632 1836 rundll32.exe 85 PID 1836 wrote to memory of 1632 1836 rundll32.exe 85 PID 1836 wrote to memory of 1632 1836 rundll32.exe 85 PID 1632 wrote to memory of 2500 1632 rundll32mgr.exe 86 PID 1632 wrote to memory of 2500 1632 rundll32mgr.exe 86 PID 1632 wrote to memory of 2500 1632 rundll32mgr.exe 86 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 976 2500 WaterMark.exe 87 PID 2500 wrote to memory of 3684 2500 WaterMark.exe 94 PID 2500 wrote to memory of 3684 2500 WaterMark.exe 94 PID 2500 wrote to memory of 4376 2500 WaterMark.exe 95 PID 2500 wrote to memory of 4376 2500 WaterMark.exe 95 PID 4376 wrote to memory of 4076 4376 iexplore.exe 97 PID 4376 wrote to memory of 4076 4376 iexplore.exe 97 PID 3684 wrote to memory of 412 3684 iexplore.exe 96 PID 4376 wrote to memory of 4076 4376 iexplore.exe 97 PID 3684 wrote to memory of 412 3684 iexplore.exe 96 PID 3684 wrote to memory of 412 3684 iexplore.exe 96
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73a7af12fdb9bbc4ace34d92d13713f7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73a7af12fdb9bbc4ace34d92d13713f7_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 2126⤵
- Program crash
PID:2604
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3684 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:412
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4376 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4076
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 976 -ip 9761⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{524C516C-4B39-11EF-A174-F2AA1BA6131E}.dat
Filesize5KB
MD581913f4e2037b7e66e0a5a75a2a544da
SHA14a5d3a451a05672316d430cb57a5cf9939037d4c
SHA256c35f08aaa5dd0bfe3c6ca20687ef43a281060c890b183d47b3670f699be3b66f
SHA512afe7cae2722d29455116731dbc531c05a66eab40c6c3afb8abb9b700c25db6e23bb81cc58cbe788231da23ad11912a428385c29d09aca37d6637625cf81daf6d
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{524EB44B-4B39-11EF-A174-F2AA1BA6131E}.dat
Filesize3KB
MD578971d354134d88256dfa12739586672
SHA12f4885c62f0277c55aff030647b22ef8bb4078e1
SHA2566af1c8817bd5ec7dfe37ccc82f34f6711c4f5d62a1de1ac8343af07e4a5f51cd
SHA512ca40c98ce928900aa1c0b61f82291475714871d6f6f3b4d23132e88e233a626cc8a941e7dbc1e2006dcc605c01619620e9b954190f1148b95f8f0a6423278a88
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
191KB
MD58ac07808142b6ca7d2b201c1c207bcbc
SHA1b250de4f26140f2166360577fdb12114c658dad2
SHA2565884f7434b8e4293517ab49f313864d170ccbcf4265786d15b493c340074422d
SHA512501209df5309013d96953ee0004d3387ff79f3414b74e06b04ecc77e5f196687da5e560141006d1fe5d0d50fc3e89d5cc8f56545947343e50c2cec75a027868c