Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 08:44
Behavioral task
behavioral1
Sample
956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
-
Size
30KB
-
MD5
956044ce35d3308d51cf4080100a3386
-
SHA1
4c4a00844be543b7a1054e1207476ad4f48ffbdb
-
SHA256
99d3ae5694fb2a00600caa7a529bd370bedf088f83d49c8d8dfd133077359af7
-
SHA512
3fd5faf906b66ab6344d1cbd5d409082aa3343296636e580b32dd9f29df8c88e9dd88a2c98826c3e6907618e31abb4992712acd30ad1b93a8ba6cd566074caa1
-
SSDEEP
768:KR6ssqyTrtz0pb5O0Z5bDbnxvwrwxsSGWlliIicQ:KertYO0Z1V3jGWllo
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3732-0-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/3732-1-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/3732-3-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/3732-11-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "233" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1912 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3732 wrote to memory of 3252 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 97 PID 3732 wrote to memory of 3252 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 97 PID 3732 wrote to memory of 3252 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 97 PID 3732 wrote to memory of 668 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 100 PID 3732 wrote to memory of 668 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 100 PID 3732 wrote to memory of 668 3732 956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows9x.bat2⤵
- System Location Discovery: System Language Discovery
PID:3252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows9x.bat2⤵PID:668
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3961855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232B
MD5f0bf6fd0018f073c294f6c013e7d11ac
SHA17f9e3accaa4520d5882145e48d00ac275cbb12a8
SHA2560718929da107997a16b9a99389fb63c539ab6e30a69e54828fb0d002ea53206b
SHA51289b9cf4df80bc180f98afaae3ad20d2d16975a1035cd80a37e3a5c529cc2288b1794221e687b2d366a57def4b7f578daf780f2eff6ed96788b097293854a7d14