Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe
-
Size
116KB
-
MD5
aa165c856b3bc7c3e331117d655ccbee
-
SHA1
3e36e6220b9f2bed5912706ddf9424f87e0c321e
-
SHA256
ce4fc27a6d12c2258d8255a103eb6c296430a62385ece1b1fee42ec1396be92e
-
SHA512
29ab13206e79282b6babb4b5721bf78b3e81c29c19f5d8f72fbf83bc808b8751faa2b21d432386af0a4180ce72181294788463c0332b45bbdba748be8a58e0c9
-
SSDEEP
1536:A+cIRG3cyfCapmE5zkons4MBikY+msHH0o4vwo3L2YRTB6m8AJ05:AF4M6dE5zkPBir+miUoUEYRTB6ZYQ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaewoom.exe -
Executes dropped EXE 1 IoCs
pid Process 2112 kaewoom.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /P" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /F" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /m" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /X" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /n" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /o" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /o" aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /T" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /x" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /W" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /a" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /H" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /u" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /N" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /R" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /y" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /M" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /L" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /r" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /U" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /c" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /D" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /Y" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /j" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /G" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /B" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /g" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /w" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /f" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /I" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /E" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /k" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /A" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /v" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /i" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /e" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /h" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /z" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /p" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /q" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /Z" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /s" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /t" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /b" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /d" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /O" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /V" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /K" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /J" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /l" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /C" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /S" kaewoom.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaewoom = "C:\\Users\\Admin\\kaewoom.exe /Q" kaewoom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kaewoom.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe 2112 kaewoom.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 2112 kaewoom.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2112 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2112 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2112 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2112 2360 aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\kaewoom.exe"C:\Users\Admin\kaewoom.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD593567291c2413ac8330d321b54bb1096
SHA156cfc493e54fe7cfeefb7d0249db4b7140cfefe7
SHA256a52a3927dab2394ed9e8c4987a0e1499c27c1f0423893c365d4eb365b5a28b74
SHA512cbb47f7b3c0dc1cbf8191ff67d0c2e6c9b02f0506b5b51501a789325d3e5637baaf47201656ad104b3d068f4c6232b20356699a04d4d642354877db66d81bd9d