Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe
-
Size
84KB
-
MD5
bce1c4eab4cc9dc82cce0f360ce22edb
-
SHA1
15ea0e6a88f2c1979dd3d6f135f4591031baf639
-
SHA256
f2910adb30a6f61cbc56141f8625c1ec46ba631e6856616f716ca0e390beb824
-
SHA512
73f4b7a1bc8e3153baa10a60cdbd3231f977c082f000a980f73c9d2334c96882b73c238eea8c84a35fc570ab372c70db6d0a5017c7c36b8b2c1616db2ed5e80b
-
SSDEEP
1536:9uJAbqy3Zoz21uNfuiLOeWGNOJ6IDo5gkR4GxoRZsQvo2t:9AtypoU2LORGNOhKgkRP2t
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CmSTP = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\cmstp.exe /waitservice" bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MqtgSVC = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\mqtgsvc.exe /waitservice" bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2752 mstsc.exe -
Loads dropped DLL 2 IoCs
pid Process 1320 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 1320 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\MICROS~1\\clipsrv.exe /waitservice" bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2752 1320 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 33 PID 1320 wrote to memory of 2752 1320 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 33 PID 1320 wrote to memory of 2752 1320 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 33 PID 1320 wrote to memory of 2752 1320 bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bce1c4eab4cc9dc82cce0f360ce22edb_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\mstsc.exeC:\Users\Admin\AppData\Local\Temp\mstsc.exe /waitservice2⤵
- Executes dropped EXE
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5bce1c4eab4cc9dc82cce0f360ce22edb
SHA115ea0e6a88f2c1979dd3d6f135f4591031baf639
SHA256f2910adb30a6f61cbc56141f8625c1ec46ba631e6856616f716ca0e390beb824
SHA51273f4b7a1bc8e3153baa10a60cdbd3231f977c082f000a980f73c9d2334c96882b73c238eea8c84a35fc570ab372c70db6d0a5017c7c36b8b2c1616db2ed5e80b