Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
c1c5d43ff410806d565e674b124cd185
-
SHA1
02c43b7af23015120dd5142ddb357c723a9de610
-
SHA256
3825e10dab931b98dba12143a8a32ad97d372365c0e3ebfb25f2bccc99260752
-
SHA512
0d15b825dda1a23b28dc0e8d083dbcec3c881565b44e7c9b5700e651801966fd38bde6360e2017c60fbc8a7f7e5f09ea3ad440d392b626e9c3d08958d54da256
-
SSDEEP
98304:TDqPo5hz1aRxcSUDk36SA5dhvxWa9P593R8yAVp2H:TDqPK1Cxcxk3ZA5UadzR8yc4H
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3059) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 3 IoCs
pid Process 2712 mssecsvc.exe 2756 mssecsvc.exe 2792 tasksche.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mssecsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe mssecsvc.exe File created C:\WINDOWS\mssecsvc.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCDF4063-D1F8-46F5-9DD6-7BA99BE97C4E}\WpadDecisionReason = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCDF4063-D1F8-46F5-9DD6-7BA99BE97C4E}\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCDF4063-D1F8-46F5-9DD6-7BA99BE97C4E}\9e-06-d8-2a-e8-b9 mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCDF4063-D1F8-46F5-9DD6-7BA99BE97C4E} mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCDF4063-D1F8-46F5-9DD6-7BA99BE97C4E}\WpadDecisionTime = 6055960643f7da01 mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCDF4063-D1F8-46F5-9DD6-7BA99BE97C4E}\WpadNetworkName = "Network 3" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mssecsvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-06-d8-2a-e8-b9 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-06-d8-2a-e8-b9\WpadDecisionReason = "1" mssecsvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-06-d8-2a-e8-b9\WpadDecisionTime = 6055960643f7da01 mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-06-d8-2a-e8-b9\WpadDecision = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mssecsvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 1620 wrote to memory of 2196 1620 rundll32.exe 30 PID 2196 wrote to memory of 2712 2196 rundll32.exe 31 PID 2196 wrote to memory of 2712 2196 rundll32.exe 31 PID 2196 wrote to memory of 2712 2196 rundll32.exe 31 PID 2196 wrote to memory of 2712 2196 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1c5d43ff410806d565e674b124cd185_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2712 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i4⤵
- Executes dropped EXE
PID:2792
-
-
-
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5600059a4a1cfabbdd7240fff9b183b24
SHA10fb75a0c4915731123d01776e58d6d8ce9cd9cea
SHA2564db79e0b97a6003fbb22d274fcd80a75624ac3eee73347d7633bc08224b8ca2e
SHA512094e342f31cefd8a1a00b54011daa1ad431dd5e9a3dec609ae48acc0d5ffdd50320aa1de223bb32657144552f415c7324161042679857e0e20c8bc594d7bb9b8
-
Filesize
3.4MB
MD5cfdd0c51c79178c57caa29007e5b88ce
SHA1e46e1e5d856c6595baff21dc1d5caafde99b4539
SHA2560324464212289861f1601b70c2e7152017a86d45ac64242015d60792b5f8e31d
SHA512005edd387a2575103927acdc78fcc8a869807f408be79ddd264a4cf01c8886ab7087cad7086351f3c04d16c2695c1324be5b9f62769bc44908de111d08379762