Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
-
Size
141KB
-
MD5
8a9d2d636c3eb83778a71d2912eaab6e
-
SHA1
2df18d58f2ee33b15ee38eae2120110db9235377
-
SHA256
d4594268a88e3240b8a3798b395f95af67d53eae1f58828df6e105dd655864c5
-
SHA512
35176a61fafd73d9440769d26274cc42c94ce7d319a90f011ef9d073bbb16d815d98d36afb26ffd74cedf788bb1ba9083f318a13d1af424514f707b069e375f2
-
SSDEEP
1536:4qTPSrAkdxOz/UY1pDC3iFA/cZ2IKpIPHvaSq/yiU/GOao8sCnEMvDY7hfhUxdcm:XT6k+2X3DASA/9IZPaPsaEMryqWxF7O
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2656 netsh.exe -
Deletes itself 1 IoCs
pid Process 1780 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2684 foqyva.exe -
Loads dropped DLL 2 IoCs
pid Process 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\{AB502C2B-5B90-4B28-768A-5FC69DA908E6} = "C:\\Users\\Admin\\AppData\\Roaming\\Ybare\\foqyva.exe" foqyva.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2276 set thread context of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Privacy 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\506F7DFF-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe 2684 foqyva.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe Token: SeSecurityPrivilege 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe Token: SeSecurityPrivilege 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe Token: SeManageVolumePrivilege 1716 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1716 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1716 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1716 WinMail.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2760 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 30 PID 2276 wrote to memory of 2760 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 30 PID 2276 wrote to memory of 2760 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 30 PID 2276 wrote to memory of 2760 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 30 PID 2276 wrote to memory of 2684 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 32 PID 2276 wrote to memory of 2684 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 32 PID 2276 wrote to memory of 2684 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 32 PID 2276 wrote to memory of 2684 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 32 PID 2760 wrote to memory of 2656 2760 cmd.exe 33 PID 2760 wrote to memory of 2656 2760 cmd.exe 33 PID 2760 wrote to memory of 2656 2760 cmd.exe 33 PID 2760 wrote to memory of 2656 2760 cmd.exe 33 PID 2684 wrote to memory of 1116 2684 foqyva.exe 19 PID 2684 wrote to memory of 1116 2684 foqyva.exe 19 PID 2684 wrote to memory of 1116 2684 foqyva.exe 19 PID 2684 wrote to memory of 1116 2684 foqyva.exe 19 PID 2684 wrote to memory of 1116 2684 foqyva.exe 19 PID 2684 wrote to memory of 1176 2684 foqyva.exe 20 PID 2684 wrote to memory of 1176 2684 foqyva.exe 20 PID 2684 wrote to memory of 1176 2684 foqyva.exe 20 PID 2684 wrote to memory of 1176 2684 foqyva.exe 20 PID 2684 wrote to memory of 1176 2684 foqyva.exe 20 PID 2684 wrote to memory of 1196 2684 foqyva.exe 21 PID 2684 wrote to memory of 1196 2684 foqyva.exe 21 PID 2684 wrote to memory of 1196 2684 foqyva.exe 21 PID 2684 wrote to memory of 1196 2684 foqyva.exe 21 PID 2684 wrote to memory of 1196 2684 foqyva.exe 21 PID 2684 wrote to memory of 1348 2684 foqyva.exe 23 PID 2684 wrote to memory of 1348 2684 foqyva.exe 23 PID 2684 wrote to memory of 1348 2684 foqyva.exe 23 PID 2684 wrote to memory of 1348 2684 foqyva.exe 23 PID 2684 wrote to memory of 1348 2684 foqyva.exe 23 PID 2684 wrote to memory of 2276 2684 foqyva.exe 29 PID 2684 wrote to memory of 2276 2684 foqyva.exe 29 PID 2684 wrote to memory of 2276 2684 foqyva.exe 29 PID 2684 wrote to memory of 2276 2684 foqyva.exe 29 PID 2684 wrote to memory of 2276 2684 foqyva.exe 29 PID 2684 wrote to memory of 1716 2684 foqyva.exe 34 PID 2684 wrote to memory of 1716 2684 foqyva.exe 34 PID 2684 wrote to memory of 1716 2684 foqyva.exe 34 PID 2684 wrote to memory of 1716 2684 foqyva.exe 34 PID 2684 wrote to memory of 1716 2684 foqyva.exe 34 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2276 wrote to memory of 1780 2276 8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe 35 PID 2684 wrote to memory of 3020 2684 foqyva.exe 37 PID 2684 wrote to memory of 3020 2684 foqyva.exe 37 PID 2684 wrote to memory of 3020 2684 foqyva.exe 37 PID 2684 wrote to memory of 3020 2684 foqyva.exe 37 PID 2684 wrote to memory of 3020 2684 foqyva.exe 37 PID 2684 wrote to memory of 1392 2684 foqyva.exe 38 PID 2684 wrote to memory of 1392 2684 foqyva.exe 38 PID 2684 wrote to memory of 1392 2684 foqyva.exe 38 PID 2684 wrote to memory of 1392 2684 foqyva.exe 38 PID 2684 wrote to memory of 1392 2684 foqyva.exe 38
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6211b072.bat"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2656
-
-
-
C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp83de82a6.bat"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1780
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1348
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1716
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:3020
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1392
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD531b45715098c04c63e114b5235c8db7e
SHA14271f446d9f8a31897625786bee40e008b003dc2
SHA256334b5bcf0f1dfd4bdac9c13f0d2faa8b62ca6b148adf0d21585001aa13a454cd
SHA512a470da1652c3b5b96d84269bd6279c962220d2d5dc7855617abf4ce79cf637f91bdf92a7274400918013f088777323a04e7fd906c85ffbb523d52f67e374cab4
-
Filesize
201B
MD52d86367bf62ece253d11a705316b2f3b
SHA1ff3ca79572b3df65c75b0da3d7f5ebd38ec36813
SHA2562c9a9e443bcc007bacc98b0c7cfaad3efe2bbc1ac5d0cb168f385aa9adfb1a62
SHA512a9effb23baaf2b333beaf9403123b87163a402c5f928b6547ce052da0943c9438593ee31729e940c320935fe7aeeeb8a772be0d608667fc48620b4f6fb64134b
-
Filesize
271B
MD577b65031cddb0b59ca7d496ac44ebc46
SHA1289e88b8e7db72f560cf12de0c52b156672d5aa8
SHA2562ca540de23857da76e7d84cd610705a0b3ab75811d070459f060ab7f19777076
SHA5127b991ddd1d96336016a146e1f28b6343a702fd57b08b5b57f3547f1a7c0937b81d5da8bfacce98ae37709c01eb525c1f10d143508a5a541ad25551a9f1e33143
-
Filesize
380B
MD5a2416c1f83939e99429c7b0b2ff441e9
SHA176a25b4116df4cec71450d5949bea02b70bd1358
SHA256dbb8200a57f06321f551d9ea40f9a2e0d650868d5c7c34a4341020c25fecae42
SHA512edc005ab5e3fa84aaa4481a33a309b62018705ee477c1aa8fd221cd3e9c7d78786c71f399a9baf41b00335f277d836990e51f70d650d9dc34ddcd58918c7bdf5
-
Filesize
141KB
MD531a36b22a3f6ae8f438fe3b752efbc26
SHA1584b7e8f5c8b811fa6f920b1ec06425a2eabd84c
SHA256eb643c947fa51b8a4a39ce509fc4e51cd8af39b74a8451b8dd8b54a2c7316f7d
SHA51295e66dfe1371ab29ef1d9b3c1b8f1851e256b6f9c93d17aa8534f3e4df482dc66c8d6787f5555150fca4d10a9f78bf58e7319783e9407683bc6090b403ef7a43