Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 18:01
Behavioral task
behavioral1
Sample
ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe
-
Size
166KB
-
MD5
ac0481970b8179b32a19ab74a8103213
-
SHA1
568fb287eb2287a09f4643d9d298081766b85195
-
SHA256
529ad0216f546c999d7ca20bb6771ab7d95e28064976253d82ad40d8fe18ca46
-
SHA512
ec2466b4b94df8849b37ef4888d4ee0ac9ce64c42be600696017582d90e772e37d4353b72fabb7d915a515ef52e9b27a8b315116c0c79f59f414506956513442
-
SSDEEP
3072:4VK8Nx+ZH/032dR/boobSBiU4TwYcu+1CeizFmVqvWEIq8E+jod0kMAgB:h8NxI032PboUSBopS1CFBO28E8od0k/W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1612 Recycle.Bin.exe -
Loads dropped DLL 2 IoCs
pid Process 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2548-3-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/2548-1-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/files/0x0008000000016c4b-6.dat upx behavioral1/memory/1612-14-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1612-21-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1612-17-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1612-16-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1612-15-0x0000000000400000-0x000000000048A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Recycle.Bin.exe = "C:\\Recycle.Bin\\Recycle.Bin.exe" Recycle.Bin.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Recycle.Bin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PhishingFilter Recycle.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" Recycle.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" Recycle.Bin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery Recycle.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" Recycle.Bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe 1612 Recycle.Bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe Token: SeDebugPrivilege 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe Token: SeDebugPrivilege 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe Token: SeDebugPrivilege 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe Token: SeDebugPrivilege 1612 Recycle.Bin.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1200 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 21 PID 2548 wrote to memory of 384 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 3 PID 2548 wrote to memory of 432 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 5 PID 2548 wrote to memory of 492 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 7 PID 2548 wrote to memory of 500 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 8 PID 2548 wrote to memory of 612 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 9 PID 2548 wrote to memory of 692 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 10 PID 2548 wrote to memory of 776 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 11 PID 2548 wrote to memory of 824 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 12 PID 2548 wrote to memory of 852 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 13 PID 2548 wrote to memory of 976 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 15 PID 2548 wrote to memory of 296 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 16 PID 2548 wrote to memory of 964 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 17 PID 2548 wrote to memory of 1084 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 18 PID 2548 wrote to memory of 1100 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 19 PID 2548 wrote to memory of 1164 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 20 PID 2548 wrote to memory of 1200 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 21 PID 2548 wrote to memory of 1416 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 23 PID 2548 wrote to memory of 1600 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 24 PID 2548 wrote to memory of 1020 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 25 PID 2548 wrote to memory of 2268 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 26 PID 2548 wrote to memory of 2304 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 27 PID 2548 wrote to memory of 2464 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 28 PID 2548 wrote to memory of 1612 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 30 PID 2548 wrote to memory of 1612 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 30 PID 2548 wrote to memory of 1612 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 30 PID 2548 wrote to memory of 1612 2548 ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe 30 PID 1612 wrote to memory of 1200 1612 Recycle.Bin.exe 21 PID 1612 wrote to memory of 384 1612 Recycle.Bin.exe 3 PID 1612 wrote to memory of 432 1612 Recycle.Bin.exe 5 PID 1612 wrote to memory of 492 1612 Recycle.Bin.exe 7 PID 1612 wrote to memory of 500 1612 Recycle.Bin.exe 8 PID 1612 wrote to memory of 612 1612 Recycle.Bin.exe 9 PID 1612 wrote to memory of 692 1612 Recycle.Bin.exe 10 PID 1612 wrote to memory of 776 1612 Recycle.Bin.exe 11 PID 1612 wrote to memory of 824 1612 Recycle.Bin.exe 12 PID 1612 wrote to memory of 852 1612 Recycle.Bin.exe 13 PID 1612 wrote to memory of 976 1612 Recycle.Bin.exe 15 PID 1612 wrote to memory of 296 1612 Recycle.Bin.exe 16 PID 1612 wrote to memory of 964 1612 Recycle.Bin.exe 17 PID 1612 wrote to memory of 1084 1612 Recycle.Bin.exe 18 PID 1612 wrote to memory of 1100 1612 Recycle.Bin.exe 19 PID 1612 wrote to memory of 1164 1612 Recycle.Bin.exe 20 PID 1612 wrote to memory of 1200 1612 Recycle.Bin.exe 21 PID 1612 wrote to memory of 1416 1612 Recycle.Bin.exe 23 PID 1612 wrote to memory of 1600 1612 Recycle.Bin.exe 24 PID 1612 wrote to memory of 1020 1612 Recycle.Bin.exe 25 PID 1612 wrote to memory of 2268 1612 Recycle.Bin.exe 26 PID 1612 wrote to memory of 2304 1612 Recycle.Bin.exe 27 PID 1612 wrote to memory of 2548 1612 Recycle.Bin.exe 29 PID 1612 wrote to memory of 1128 1612 Recycle.Bin.exe 31 PID 1612 wrote to memory of 3000 1612 Recycle.Bin.exe 32
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:612
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:1600
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1020
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:1128
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"2⤵PID:1164
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:852
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:3000
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:296
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1084
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac0481970b8179b32a19ab74a8103213_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Recycle.Bin\Recycle.Bin.exe"C:\Recycle.Bin\Recycle.Bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵PID:1416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:2268
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3604179530\zmstage.exeC:\Users\Admin\AppData\Local\Temp\3604179530\zmstage.exe1⤵PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b054402f4de4718cc54a15ea8a3bfae1
SHA1881c94f6cec1c83a577b943d60bb4f2e18c97172
SHA256ff1ef73f86e3cfef5a56c9abf78e125c6bd841a28778166052817aa0095d9524
SHA5123c759b877fa234ce48b17720467fa0c70eeb08b55f381838c1bf1759ac72c7d9570ae8f734085d946e575876d4ead16696cdf628ac9665de1ae70834666cb29e
-
Filesize
166KB
MD5ac0481970b8179b32a19ab74a8103213
SHA1568fb287eb2287a09f4643d9d298081766b85195
SHA256529ad0216f546c999d7ca20bb6771ab7d95e28064976253d82ad40d8fe18ca46
SHA512ec2466b4b94df8849b37ef4888d4ee0ac9ce64c42be600696017582d90e772e37d4353b72fabb7d915a515ef52e9b27a8b315116c0c79f59f414506956513442