Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 14:07
Behavioral task
behavioral1
Sample
b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe
-
Size
757KB
-
MD5
b7eea6971453584c9c0caec2f044108c
-
SHA1
28a9bd2260f89a90de8a2ed49c492f967f130c0c
-
SHA256
28aa6312df9de132a6953f1c1ccd654e7ec6935a739cd9a35e9699b7c9740a10
-
SHA512
9e886116eacd9e6766c192a7ef0e91d9fb67a202ba8d0552f0495657158db310dade6355d8e53ffa97708fd66da2312b16fd6ee8d5c6f8708b490737763ae331
-
SSDEEP
12288:h9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKcNY:XAQ6Zx9cxTmOrucTIEFSpOGpNY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1944 set thread context of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSecurityPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSystemtimePrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeBackupPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeRestorePrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeShutdownPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeDebugPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeUndockPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeManageVolumePrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeImpersonatePrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 33 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 34 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 35 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2884 explorer.exe Token: SeSecurityPrivilege 2884 explorer.exe Token: SeTakeOwnershipPrivilege 2884 explorer.exe Token: SeLoadDriverPrivilege 2884 explorer.exe Token: SeSystemProfilePrivilege 2884 explorer.exe Token: SeSystemtimePrivilege 2884 explorer.exe Token: SeProfSingleProcessPrivilege 2884 explorer.exe Token: SeIncBasePriorityPrivilege 2884 explorer.exe Token: SeCreatePagefilePrivilege 2884 explorer.exe Token: SeBackupPrivilege 2884 explorer.exe Token: SeRestorePrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeDebugPrivilege 2884 explorer.exe Token: SeSystemEnvironmentPrivilege 2884 explorer.exe Token: SeChangeNotifyPrivilege 2884 explorer.exe Token: SeRemoteShutdownPrivilege 2884 explorer.exe Token: SeUndockPrivilege 2884 explorer.exe Token: SeManageVolumePrivilege 2884 explorer.exe Token: SeImpersonatePrivilege 2884 explorer.exe Token: SeCreateGlobalPrivilege 2884 explorer.exe Token: 33 2884 explorer.exe Token: 34 2884 explorer.exe Token: 35 2884 explorer.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2108 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 31 PID 1944 wrote to memory of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32 PID 1944 wrote to memory of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32 PID 1944 wrote to memory of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32 PID 1944 wrote to memory of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32 PID 1944 wrote to memory of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32 PID 1944 wrote to memory of 2884 1944 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2108
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
757KB
MD5b7eea6971453584c9c0caec2f044108c
SHA128a9bd2260f89a90de8a2ed49c492f967f130c0c
SHA25628aa6312df9de132a6953f1c1ccd654e7ec6935a739cd9a35e9699b7c9740a10
SHA5129e886116eacd9e6766c192a7ef0e91d9fb67a202ba8d0552f0495657158db310dade6355d8e53ffa97708fd66da2312b16fd6ee8d5c6f8708b490737763ae331