Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe
-
Size
107KB
-
MD5
b54883351421ed20db70a89a655d75ef
-
SHA1
eef43f79a979b7fdbc1ce729c91bd933118de0b6
-
SHA256
63286e6c890bf2c15c964f7264eb76795ad49aacf593683c2e52ae8a66340a35
-
SHA512
982adf5a26ad3b6a28ec88da7768c173fc3160a0cc6c05a7c161d5ef44cba6ea0c7c2231195079c1ea2607f87eaf1efe0a8334b095a369776aefe663b515b964
-
SSDEEP
1536:+r1V3k5x9zTF9V1GfC0q+j+zU8wrHvg+jjNVJAgUKT8W2cK3wy/8l/epYnG2fr9o:okx9PrmRrH/jhVJAzKTCx37s/fnhfrW
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat typstarta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language typstarta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language typstarta.exe -
Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix typstarta.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC} typstarta.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ed-43-ae-e0-c6 typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ed-43-ae-e0-c6\WpadDecisionTime = 9062c83719f4da01 typstarta.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typstarta.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings typstarta.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" typstarta.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings typstarta.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC}\de-ed-43-ae-e0-c6 typstarta.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC}\WpadDecisionTime = b073d2fc18f4da01 typstarta.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC}\WpadNetworkName = "Network 2" typstarta.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ed-43-ae-e0-c6\WpadDecision = "0" typstarta.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ed-43-ae-e0-c6\WpadDetectedUrl typstarta.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" typstarta.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC}\WpadDecisionReason = "1" typstarta.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ed-43-ae-e0-c6\WpadDecisionReason = "1" typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ed-43-ae-e0-c6\WpadDecisionTime = b073d2fc18f4da01 typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 typstarta.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" typstarta.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC}\WpadDecision = "0" typstarta.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1A026D9E-800E-41D8-83A6-DC7DD4EE05DC}\WpadDecisionTime = 9062c83719f4da01 typstarta.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2712 typstarta.exe 2712 typstarta.exe 2712 typstarta.exe 2712 typstarta.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2804 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 4 IoCs
pid Process 2480 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe 2804 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe 2168 typstarta.exe 2712 typstarta.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2804 2480 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe 30 PID 2480 wrote to memory of 2804 2480 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe 30 PID 2480 wrote to memory of 2804 2480 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe 30 PID 2480 wrote to memory of 2804 2480 b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe 30 PID 2168 wrote to memory of 2712 2168 typstarta.exe 32 PID 2168 wrote to memory of 2712 2168 typstarta.exe 32 PID 2168 wrote to memory of 2712 2168 typstarta.exe 32 PID 2168 wrote to memory of 2712 2168 typstarta.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\b54883351421ed20db70a89a655d75ef_JaffaCakes118.exe--a0589422⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:2804
-
-
C:\Windows\SysWOW64\typstarta.exe"C:\Windows\SysWOW64\typstarta.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\typstarta.exe--b1cd08602⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2712
-