Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe
-
Size
340KB
-
MD5
752d15fcc7cc25121914cdeab45f9dc6
-
SHA1
9146289552df5886f831edca03ff2e871f8b5925
-
SHA256
4cd888d3122c48bd43daf5bbbd8c30e072446d8ca90247d248c77fce5dbb8c59
-
SHA512
903d1ef8b3211b91f466d1814a83f74133ad18390453f7c8e95633dbe7ec1293341c81d118087ccfe3cdec60ea900748d4f7ec41d929ac2d3b209e1603d5bcc5
-
SSDEEP
6144:6qcOWaUEX3PtWF8ftYOiS7AcMgyDl2mS0KGwy82AFKxpme2w9mydPdm9PcBPpU:6zaUatWo2OKgywmE8ayweFBGgpU
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2892 ned.exe -
Executes dropped EXE 1 IoCs
pid Process 2892 ned.exe -
Loads dropped DLL 1 IoCs
pid Process 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open\command ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\Content Type = "application/x-msdownload" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\DefaultIcon\ = "%1" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ned.exe\" -a \"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start\command ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\ = "Application" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\DefaultIcon ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas\command ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas ned.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" ned.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ned.exe -
Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\Content Type = "application/x-msdownload" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\DefaultIcon ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas\command ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ned.exe\" -a \"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\DefaultIcon ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\ = "Application" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open\command ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\ = "exefile" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\Content Type = "application/x-msdownload" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\DefaultIcon\ = "%1" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open\command ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ned.exe\" -a \"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\start ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\start\command ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\exefile\shell\start\command ned.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\DefaultIcon\ = "%1" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas\command ned.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" ned.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1608 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2892 ned.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 2892 ned.exe 1608 explorer.exe 1608 explorer.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 1608 explorer.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 1608 explorer.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 2892 ned.exe 1608 explorer.exe 2892 ned.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2892 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2892 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2892 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2892 2852 752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\ned.exe"C:\Users\Admin\AppData\Local\ned.exe" -gav C:\Users\Admin\AppData\Local\Temp\752d15fcc7cc25121914cdeab45f9dc6_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2892
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1608
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD5752d15fcc7cc25121914cdeab45f9dc6
SHA19146289552df5886f831edca03ff2e871f8b5925
SHA2564cd888d3122c48bd43daf5bbbd8c30e072446d8ca90247d248c77fce5dbb8c59
SHA512903d1ef8b3211b91f466d1814a83f74133ad18390453f7c8e95633dbe7ec1293341c81d118087ccfe3cdec60ea900748d4f7ec41d929ac2d3b209e1603d5bcc5