Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe
-
Size
436KB
-
MD5
a4bdcefd97821332f39852f00b54a742
-
SHA1
81018ef6ef0a11412b029524d865ae36ab6d3b91
-
SHA256
d81b77c97e07449962abea2cf2b939fd58baf0428310be72d8e7654722b4dcc2
-
SHA512
243e49ce01c56ee1a9eeb6824712044eb81f88a3dc199b408edb32b99534d5b45f29687586ac0ae2bec1acea9d0ac1fe2188d29227638f386e527cf49456fe73
-
SSDEEP
6144:BpPDCOkXvBftF2WKcxQIop4T6jjtmUIM9n8xrF50uZPpvEoFuK/w:fCVZftAZcxtT62bbDvEU
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\taskmngr.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmngr.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Task Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmngr.exe" a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA79CFA9-CBDF-42EF-F2F1-E0E3EF3D9BD5}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmngr.exe" a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DA79CFA9-CBDF-42EF-F2F1-E0E3EF3D9BD5} a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DA79CFA9-CBDF-42EF-F2F1-E0E3EF3D9BD5}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmngr.exe" a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA79CFA9-CBDF-42EF-F2F1-E0E3EF3D9BD5} a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Task Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmngr.exe" a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Task Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taskmngr.exe" a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3336 set thread context of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4752 reg.exe 3420 reg.exe 4316 reg.exe 3916 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeCreateTokenPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeLockMemoryPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeMachineAccountPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeTcbPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeSecurityPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeSystemtimePrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeBackupPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeRestorePrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeShutdownPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeDebugPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeAuditPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeUndockPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeSyncAgentPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeManageVolumePrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeImpersonatePrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: 31 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: 32 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: 33 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: 34 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe Token: 35 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 3336 wrote to memory of 2336 3336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 87 PID 2336 wrote to memory of 3712 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 88 PID 2336 wrote to memory of 3712 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 88 PID 2336 wrote to memory of 3712 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 88 PID 2336 wrote to memory of 2504 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 89 PID 2336 wrote to memory of 2504 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 89 PID 2336 wrote to memory of 2504 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 89 PID 2336 wrote to memory of 3416 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 90 PID 2336 wrote to memory of 3416 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 90 PID 2336 wrote to memory of 3416 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 90 PID 2336 wrote to memory of 4520 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 91 PID 2336 wrote to memory of 4520 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 91 PID 2336 wrote to memory of 4520 2336 a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe 91 PID 2504 wrote to memory of 4752 2504 cmd.exe 96 PID 2504 wrote to memory of 4752 2504 cmd.exe 96 PID 2504 wrote to memory of 4752 2504 cmd.exe 96 PID 4520 wrote to memory of 4316 4520 cmd.exe 97 PID 4520 wrote to memory of 4316 4520 cmd.exe 97 PID 4520 wrote to memory of 4316 4520 cmd.exe 97 PID 3712 wrote to memory of 3420 3712 cmd.exe 98 PID 3712 wrote to memory of 3420 3712 cmd.exe 98 PID 3712 wrote to memory of 3420 3712 cmd.exe 98 PID 3416 wrote to memory of 3916 3416 cmd.exe 99 PID 3416 wrote to memory of 3916 3416 cmd.exe 99 PID 3416 wrote to memory of 3916 3416 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3420
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a4bdcefd97821332f39852f00b54a742_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3916
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\taskmngr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\taskmngr.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\taskmngr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\taskmngr.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4316
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34B
MD5691a21bd9c6ece34a365ae238625d20f
SHA1e5b4ef0be0baa478dfd4ccb4d2bbcfced4c80d5d
SHA256169920779d86cc6afd085e8de2c4d6e93e8c238e6444091998c255855f249c71
SHA512c3318a7ffea38504d1d460b7aa2294def42188b88b15720d7bc23dc5c1689c65c67b966d1eeffeb754065914ffadef983b6f182147acbb765b4fe0d95fa0741c