Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 10:15
Behavioral task
behavioral1
Sample
aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe
-
Size
360KB
-
MD5
aa9bb6ba3dfeca63c997ec2da89fb61c
-
SHA1
26d783f02245a10c60d291d3f95f071695685fb7
-
SHA256
94a2dcfdbce60c902ff131b2304d7b2ecd1c2eb4e84faa391f1c926f27da67cb
-
SHA512
86a5c320062c91319714f331fe40866469c837d301d07b54e8a1e1a60e387d066b2d3058e33a0040fa783bca24705902a34640ee52b4f9ad45776c5db674d463
-
SSDEEP
6144:U4rvXy29kyG1X1tZuwmzFBPjQ1LcWEi2Keamies6Oo418ufBJBL6Hg9JLaNgkiE1:U4rvXtvu1exHPjPbKvqs689LUg9YWKhj
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2892 netsh.exe 1964 netsh.exe 1992 netsh.exe -
resource yara_rule behavioral1/files/0x00060000000185e6-6.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2780 smss.exe -
Loads dropped DLL 2 IoCs
pid Process 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\internet = "\"C:\\Windows\\system\\smss.exe\"" smss.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\BOOTEX.LOG cmd.exe File created C:\Windows\SysWOW64\Bubbles.scr aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Ribbons.scr aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\BOOTEX.LOG cmd.exe File created C:\Windows\SysWOW64\Mystify.scr aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ssText3d.scr aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\SysWOW64\AUTOEXEC.BAT smss.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Real\Update_OB\realsched.exe smss.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\IsUninst.exe aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\IsUn0804.exe aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\IsUn0404.exe aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File created C:\Windows\system\smss.exe aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe File opened for modification C:\Windows\system\smss.exe aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Event Triggered Execution: Screensaver 1 TTPs 3 IoCs
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveActive = "1" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\ssText3d.scr" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\ssText3d.scr" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveActive = "1" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe -
Modifies registry class 19 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\DefaultValue = "1" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "\"C:\\Windows\\system\\smss.exe\" \"%1\"" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\CheckedValue = "2" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\DefaultValue = "2" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\UncheckedValue = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\CheckedValue = "0" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue = "1" smss.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe 2780 smss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 smss.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe 2780 smss.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2780 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe 30 PID 2780 wrote to memory of 2656 2780 smss.exe 31 PID 2780 wrote to memory of 2656 2780 smss.exe 31 PID 2780 wrote to memory of 2656 2780 smss.exe 31 PID 2780 wrote to memory of 2656 2780 smss.exe 31 PID 2780 wrote to memory of 2264 2780 smss.exe 33 PID 2780 wrote to memory of 2264 2780 smss.exe 33 PID 2780 wrote to memory of 2264 2780 smss.exe 33 PID 2780 wrote to memory of 2264 2780 smss.exe 33 PID 2656 wrote to memory of 2564 2656 cmd.exe 35 PID 2656 wrote to memory of 2564 2656 cmd.exe 35 PID 2656 wrote to memory of 2564 2656 cmd.exe 35 PID 2656 wrote to memory of 2564 2656 cmd.exe 35 PID 2564 wrote to memory of 652 2564 net.exe 36 PID 2564 wrote to memory of 652 2564 net.exe 36 PID 2564 wrote to memory of 652 2564 net.exe 36 PID 2564 wrote to memory of 652 2564 net.exe 36 PID 2656 wrote to memory of 2892 2656 cmd.exe 37 PID 2656 wrote to memory of 2892 2656 cmd.exe 37 PID 2656 wrote to memory of 2892 2656 cmd.exe 37 PID 2656 wrote to memory of 2892 2656 cmd.exe 37 PID 2656 wrote to memory of 1964 2656 cmd.exe 38 PID 2656 wrote to memory of 1964 2656 cmd.exe 38 PID 2656 wrote to memory of 1964 2656 cmd.exe 38 PID 2656 wrote to memory of 1964 2656 cmd.exe 38 PID 2656 wrote to memory of 1992 2656 cmd.exe 39 PID 2656 wrote to memory of 1992 2656 cmd.exe 39 PID 2656 wrote to memory of 1992 2656 cmd.exe 39 PID 2656 wrote to memory of 1992 2656 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa9bb6ba3dfeca63c997ec2da89fb61c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Event Triggered Execution: Screensaver
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system\smss.exe"C:\Windows\system\smss.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\AUTOEXEC.BAT3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\net.exenet stop "Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)"5⤵
- System Location Discovery: System Language Discovery
PID:652
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set notifications disable4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2892
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode enable enable4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1964
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram C:\Windows\system\smss.exe POCO4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\AUTOEXEC.BAT3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2264
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Netsh Helper DLL
1Screensaver
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Netsh Helper DLL
1Screensaver
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD5aa9bb6ba3dfeca63c997ec2da89fb61c
SHA126d783f02245a10c60d291d3f95f071695685fb7
SHA25694a2dcfdbce60c902ff131b2304d7b2ecd1c2eb4e84faa391f1c926f27da67cb
SHA51286a5c320062c91319714f331fe40866469c837d301d07b54e8a1e1a60e387d066b2d3058e33a0040fa783bca24705902a34640ee52b4f9ad45776c5db674d463
-
Filesize
365B
MD579daee967b1e7e6d7eb8d1ce0b10ef76
SHA18ecc12159b37c8b08f81a7b750619da318b8dcd4
SHA256b8812fe1e49ce2120f181e78d4080122dba166366a5c97bf2c70baac5380a53a
SHA512571b39b9559edde5b154e7ccefbf99ffbe08eae3966d460d416a254ae8b2e2d4b4cdb8330dae6b28308bb84a7771f1892118009f898584c7bbb20b91a183c053