Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe
-
Size
279KB
-
MD5
75436abd2b41ab1c5b9fb6ac88b472da
-
SHA1
7da5d9857ee5838915a2cc9a22d8ceb6308d8840
-
SHA256
df850b1fdfebe1f42d363cf0347a5c5f246803a3e41a5bdd540d69434a47ad81
-
SHA512
eb4deb40daa5acbd4a1131974596c5b4bfec5416562713bc9af7b3df7e64b7a1b99308d71187004251414ced1691c80e81020ca38b89a9e9272b352f977a0221
-
SSDEEP
6144:zR0QIR7HRQbcbj03j5h3HVkw9yxDpkI9VqF6bmsdGnX:z63j03j5Qw9yBpvqF6aIGX
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2096 9AE8.tmp -
Loads dropped DLL 2 IoCs
pid Process 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1624-1-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1624-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/652-13-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/652-12-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/652-15-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1624-16-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1624-84-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1980-87-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1624-88-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1624-191-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1624-194-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5F2.exe = "C:\\Program Files (x86)\\LP\\D3A5\\5F2.exe" 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\D3A5\5F2.exe 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\D3A5\9AE8.tmp 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\D3A5\5F2.exe 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE8.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2404 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeSecurityPrivilege 2140 msiexec.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe Token: SeShutdownPrivilege 2404 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1624 wrote to memory of 652 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 31 PID 1624 wrote to memory of 652 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 31 PID 1624 wrote to memory of 652 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 31 PID 1624 wrote to memory of 652 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 31 PID 1624 wrote to memory of 1980 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 33 PID 1624 wrote to memory of 1980 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 33 PID 1624 wrote to memory of 1980 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 33 PID 1624 wrote to memory of 1980 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 33 PID 1624 wrote to memory of 2096 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 34 PID 1624 wrote to memory of 2096 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 34 PID 1624 wrote to memory of 2096 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 34 PID 1624 wrote to memory of 2096 1624 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe 34 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\5F9E4\1AED3.exe%C:\Users\Admin\AppData\Roaming\5F9E42⤵
- System Location Discovery: System Language Discovery
PID:652
-
-
C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe startC:\Program Files (x86)\E495B\lvvm.exe%C:\Program Files (x86)\E495B2⤵
- System Location Discovery: System Language Discovery
PID:1980
-
-
C:\Program Files (x86)\LP\D3A5\9AE8.tmp"C:\Program Files (x86)\LP\D3A5\9AE8.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55d5c60a88239ee4f5e54174668207224
SHA13c8ae337fd50aa0d5821f1570c4c1fd7b972c0c6
SHA256e719440f8bfb1e4090bff6b9d4eb5b11c5dbd275c836ebe16ddcf1eee1cfeb1d
SHA512ad0006c3efd0410789754ccba8aaaf82f361ef4f7b24bd3f8565e80666ae9a836dfd70e298614b7b99c4e2e57ced6afc27b70c1c7eda99d97720782dfb016233
-
Filesize
1KB
MD55ca449dc56279a79c2bcc4c347c206c0
SHA1b27aeba3cac157766b8fe9538025769b73d9c98b
SHA256676be2e14ae7fae5bf12f0b24480d7d20aaee00184ce7a30286e520517a9430a
SHA5120ae56c98018a4176ac8966a23e792751e7af01f6c4a3c622ad22464e1b2f460d42441eb044fcab73f2f6c5415d96379529263f3da62ce4010a21d1703cb272cd
-
Filesize
600B
MD52322fe383b0395425e4f31df298c19ff
SHA1cbbc42ae2ca85b281f0babfdd446569dd3cdfff1
SHA2567fdb94b61d243ea69335a465ba2d5fda4b9cd5e34bc66458d20b376ed194e10f
SHA512c11ba8f3b63f2fcccefa2645220225fa30f094fab2954a3ecc190453c45c65349523b19fe7af99bd61341ac39312b980a45f76b76112703a532bf3c2763cdce9
-
Filesize
996B
MD51aac325ce50b5d736aea1fa64a7b9ad4
SHA1789cefcb3d154a2bb1e6f628a7b56f1edb619f45
SHA2560b14efc2cb20878b84f34f72f44719f1e656f51a335c1d83ae13af15a4c0eaff
SHA5124121cafdce68e7662f3d7e4fc304e3cdab8176bd89288f3bdd48cb6448795d655a7bcf4405f4ade84902df519ec11e64bc52a507f58c22d2bc472996cf7e2583
-
Filesize
98KB
MD5d80b9b537e9352a07cf0832971882498
SHA14f3c79ad91344b644ed160b843946712c9201282
SHA2562a6fa00fea45fa4c2947c1da516f8dbdc3b5c53b30e9d4f1b988edf254ddfa99
SHA5127c0f43ac9ae5d03784ce7968a935c891d255d6b6f601d1ee0b16c1f01e7b18926bb7d8b772a85eb58b9ac4331c73f241bc94c8293a9a12d81ba4bebe05e46190