Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe
-
Size
89KB
-
MD5
95e76c242eadbaf1d75503d46482c8ca
-
SHA1
d85e6e881ef477ea6111c85d80a5e2af8986cbbd
-
SHA256
6b58e0a021bf4e2ab87aec4e40b3415ee313d7d1d24be6d413334ec6f4ff0c26
-
SHA512
1bbd5cd879f2db2cd8414035996f04327e931ca65e0b127de0c553e2c0a25aacb3041eaac2a6103592d8a9d3c0744bd00283c75af765e274f92b620cffabe9ad
-
SSDEEP
768:MrFPx8ceViHNaZyiJHFlnjSSO3c1boD9d9rA49U6n1hPLJ890GMkJ5z9o6je4K6m:MByKNaZXWYEi4K6nPMbLRoMe4KBd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\DownloadSave\\muouuzy.exe" muouuzy.exe -
Deletes itself 1 IoCs
pid Process 2176 muouuzy.exe -
Executes dropped EXE 2 IoCs
pid Process 2176 muouuzy.exe 2748 muouuzy.exe -
Loads dropped DLL 4 IoCs
pid Process 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 2176 muouuzy.exe 2176 muouuzy.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: muouuzy.exe File opened (read-only) \??\T: muouuzy.exe File opened (read-only) \??\R: muouuzy.exe File opened (read-only) \??\W: muouuzy.exe File opened (read-only) \??\S: muouuzy.exe File opened (read-only) \??\Q: muouuzy.exe File opened (read-only) \??\K: muouuzy.exe File opened (read-only) \??\G: muouuzy.exe File opened (read-only) \??\X: muouuzy.exe File opened (read-only) \??\U: muouuzy.exe File opened (read-only) \??\P: muouuzy.exe File opened (read-only) \??\N: muouuzy.exe File opened (read-only) \??\M: muouuzy.exe File opened (read-only) \??\L: muouuzy.exe File opened (read-only) \??\J: muouuzy.exe File opened (read-only) \??\E: muouuzy.exe File opened (read-only) \??\B: muouuzy.exe File opened (read-only) \??\Y: muouuzy.exe File opened (read-only) \??\V: muouuzy.exe File opened (read-only) \??\O: muouuzy.exe File opened (read-only) \??\I: muouuzy.exe File opened (read-only) \??\H: muouuzy.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language muouuzy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language muouuzy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2176 muouuzy.exe Token: SeIncBasePriorityPrivilege 2748 muouuzy.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2176 muouuzy.exe 2748 muouuzy.exe 2748 muouuzy.exe 2176 muouuzy.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2176 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 31 PID 2432 wrote to memory of 2176 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 31 PID 2432 wrote to memory of 2176 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 31 PID 2432 wrote to memory of 2176 2432 95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe 31 PID 2176 wrote to memory of 2748 2176 muouuzy.exe 32 PID 2176 wrote to memory of 2748 2176 muouuzy.exe 32 PID 2176 wrote to memory of 2748 2176 muouuzy.exe 32 PID 2176 wrote to memory of 2748 2176 muouuzy.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\ProgramData\DownloadSave\muouuzy.exe"C:\ProgramData\DownloadSave\muouuzy.exe"2⤵
- Modifies WinLogon for persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\ProgramData\DownloadSave\ muouuzy.exe"C:\ProgramData\DownloadSave\ muouuzy.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260B
MD5afa19469d1bc271f1409fc50d3559ad6
SHA1234bcf5b96b1099018f3d182b99045440ef5275f
SHA256051c9b48e10495090a510f0047693f5341752ba7cf3b84423da9629fd10aa4d2
SHA5125eb6064888abcaf48c448b98393c914f75ed13f249cc03e2df867c1266972b965343278974f7ae6087ea493ae974bf47d0171cc92cf2abdb8d46e10ecda53d4c
-
Filesize
89KB
MD595e76c242eadbaf1d75503d46482c8ca
SHA1d85e6e881ef477ea6111c85d80a5e2af8986cbbd
SHA2566b58e0a021bf4e2ab87aec4e40b3415ee313d7d1d24be6d413334ec6f4ff0c26
SHA5121bbd5cd879f2db2cd8414035996f04327e931ca65e0b127de0c553e2c0a25aacb3041eaac2a6103592d8a9d3c0744bd00283c75af765e274f92b620cffabe9ad