Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 09:49
Behavioral task
behavioral1
Sample
aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
aec20eb6ee835c12214379b779745fe1
-
SHA1
5922c4043858675bc625f399b941de884279f87e
-
SHA256
ec1d168c1e24d5a5c1884c06842aa521a5d5d3d09abc77f9523d4e16dd9c5b57
-
SHA512
1154917904ed84d8fa3cb5e77d4a633520ce9383d05859fc46b644740e4eaa99ebf763ad856a8a972c9771d726fe871fe7681a68c1e20e729a9cc81c13129ccc
-
SSDEEP
24576:R8xTAL596aUsyoB0v07HkKhB0uWzxWAsoPg5t8LnVfk4R8MTBBYBoiSUAh5lLhiz:SxTI+s73SrzH8MTBKSUBSVbXEL
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe -
resource yara_rule behavioral1/files/0x0009000000016bf7-35.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 2684 fservice.exe 2904 services.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine fservice.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine services.exe -
Loads dropped DLL 6 IoCs
pid Process 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe 2904 services.exe 2904 services.exe 2684 fservice.exe 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1064-0-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/files/0x0008000000016c7c-5.dat themida behavioral1/memory/1064-6-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2684-16-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2684-17-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2684-18-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-29-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/1064-32-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-33-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2684-45-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/1064-47-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-50-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-51-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-52-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-53-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-55-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-57-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-59-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-61-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-63-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-65-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-67-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-69-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-71-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-73-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-75-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-77-0x0000000000400000-0x000000000069B000-memory.dmp themida behavioral1/memory/2904-79-0x0000000000400000-0x000000000069B000-memory.dmp themida -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\fservice.exe aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fservice.exe aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe File opened for modification C:\Windows\system\sservice.exe aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 services.exe 2904 services.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2684 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe 30 PID 1064 wrote to memory of 2684 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe 30 PID 1064 wrote to memory of 2684 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe 30 PID 1064 wrote to memory of 2684 1064 aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2904 2684 fservice.exe 31 PID 2684 wrote to memory of 2904 2684 fservice.exe 31 PID 2684 wrote to memory of 2904 2684 fservice.exe 31 PID 2684 wrote to memory of 2904 2684 fservice.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aec20eb6ee835c12214379b779745fe1_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Identifies Wine through registry keys
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5aec20eb6ee835c12214379b779745fe1
SHA15922c4043858675bc625f399b941de884279f87e
SHA256ec1d168c1e24d5a5c1884c06842aa521a5d5d3d09abc77f9523d4e16dd9c5b57
SHA5121154917904ed84d8fa3cb5e77d4a633520ce9383d05859fc46b644740e4eaa99ebf763ad856a8a972c9771d726fe871fe7681a68c1e20e729a9cc81c13129ccc
-
Filesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
Filesize
13KB
MD5b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA25645d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066