Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 22:37
Behavioral task
behavioral1
Sample
8c41194220f8afd122158c697b916777_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c41194220f8afd122158c697b916777_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
8c41194220f8afd122158c697b916777_JaffaCakes118.exe
-
Size
67KB
-
MD5
8c41194220f8afd122158c697b916777
-
SHA1
eea6c6a761f375883498f70acd556f731766a308
-
SHA256
cac3ef9cc34aa1269274b3ca8ec771c65b522a52dd028596cd827ea15b3d36f9
-
SHA512
a0a31b74f8321e634adfbaae08ccc9885e4cfdca633c98ff34af06650fba9e3a229f1a13565551789fa90f389384687c150b953fb3c47c10f5bb6c39a23bfbdc
-
SSDEEP
1536:sMl64j3JedCYRug4xlk27jSljWPeCGKX7+/n6A01HQvSvtzt:dgWJpu/gkmPe7h01+u
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2372-3-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\socks2.dll 8c41194220f8afd122158c697b916777_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c41194220f8afd122158c697b916777_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 8c41194220f8afd122158c697b916777_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 8c41194220f8afd122158c697b916777_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 8c41194220f8afd122158c697b916777_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 8c41194220f8afd122158c697b916777_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\socks2.dll" 8c41194220f8afd122158c697b916777_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2372 8c41194220f8afd122158c697b916777_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2192 2372 8c41194220f8afd122158c697b916777_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2192 2372 8c41194220f8afd122158c697b916777_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2192 2372 8c41194220f8afd122158c697b916777_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2192 2372 8c41194220f8afd122158c697b916777_JaffaCakes118.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c41194220f8afd122158c697b916777_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8c41194220f8afd122158c697b916777_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2036