Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 14:07
Behavioral task
behavioral1
Sample
b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe
-
Size
757KB
-
MD5
b7eea6971453584c9c0caec2f044108c
-
SHA1
28a9bd2260f89a90de8a2ed49c492f967f130c0c
-
SHA256
28aa6312df9de132a6953f1c1ccd654e7ec6935a739cd9a35e9699b7c9740a10
-
SHA512
9e886116eacd9e6766c192a7ef0e91d9fb67a202ba8d0552f0495657158db310dade6355d8e53ffa97708fd66da2312b16fd6ee8d5c6f8708b490737763ae331
-
SSDEEP
12288:h9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKcNY:XAQ6Zx9cxTmOrucTIEFSpOGpNY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4792 set thread context of 5036 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 98 -
Program crash 1 IoCs
pid pid_target Process procid_target 2068 4636 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSecurityPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSystemtimePrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeBackupPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeRestorePrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeShutdownPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeDebugPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeUndockPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeManageVolumePrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeImpersonatePrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 33 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 34 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 35 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: 36 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 5036 explorer.exe Token: SeSecurityPrivilege 5036 explorer.exe Token: SeTakeOwnershipPrivilege 5036 explorer.exe Token: SeLoadDriverPrivilege 5036 explorer.exe Token: SeSystemProfilePrivilege 5036 explorer.exe Token: SeSystemtimePrivilege 5036 explorer.exe Token: SeProfSingleProcessPrivilege 5036 explorer.exe Token: SeIncBasePriorityPrivilege 5036 explorer.exe Token: SeCreatePagefilePrivilege 5036 explorer.exe Token: SeBackupPrivilege 5036 explorer.exe Token: SeRestorePrivilege 5036 explorer.exe Token: SeShutdownPrivilege 5036 explorer.exe Token: SeDebugPrivilege 5036 explorer.exe Token: SeSystemEnvironmentPrivilege 5036 explorer.exe Token: SeChangeNotifyPrivilege 5036 explorer.exe Token: SeRemoteShutdownPrivilege 5036 explorer.exe Token: SeUndockPrivilege 5036 explorer.exe Token: SeManageVolumePrivilege 5036 explorer.exe Token: SeImpersonatePrivilege 5036 explorer.exe Token: SeCreateGlobalPrivilege 5036 explorer.exe Token: 33 5036 explorer.exe Token: 34 5036 explorer.exe Token: 35 5036 explorer.exe Token: 36 5036 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 4636 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 87 PID 4792 wrote to memory of 5036 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 98 PID 4792 wrote to memory of 5036 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 98 PID 4792 wrote to memory of 5036 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 98 PID 4792 wrote to memory of 5036 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 98 PID 4792 wrote to memory of 5036 4792 b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7eea6971453584c9c0caec2f044108c_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1523⤵
- Program crash
PID:2068
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 46361⤵PID:1624
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1