Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe
-
Size
773KB
-
MD5
ce38420a8eb127e33ff0b71f2730af53
-
SHA1
421d264594c2674efaadda6c80c7bec894243293
-
SHA256
75c70e1cfce580c7af9083b9a214785d13d54f3e50f6a963e9a2ef64071318ce
-
SHA512
ee02822089d80bec613e987821ad876865eb997bac560bba39dd9f92e81f4106969c6c5631af9784e4391dd9001f7577ff1155b2a2d08418125f401f5f3556a4
-
SSDEEP
12288:5Lo3AFptjgbGiAFptjgbGXeb3E2TImvOmbNtW4JWHOyUDO6nw9Er/N3tjXbli3ir:Dj37j3ODkm2mhtGO5IEr/N3/A
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe -
Executes dropped EXE 2 IoCs
pid Process 1444 Crack.exe 2612 setup.exe -
Loads dropped DLL 3 IoCs
pid Process 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1444 set thread context of 2904 1444 Crack.exe 32 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{ffb13717-266b-96bf-b67b-e9ffda7ca741}\@ Crack.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1444 Crack.exe 1444 Crack.exe 1444 Crack.exe 1444 Crack.exe 1444 Crack.exe 472 services.exe 1444 Crack.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1444 Crack.exe Token: SeDebugPrivilege 1444 Crack.exe Token: SeDebugPrivilege 1444 Crack.exe Token: SeDebugPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeShutdownPrivilege 1240 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1444 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 30 PID 2668 wrote to memory of 1444 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 30 PID 2668 wrote to memory of 1444 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 30 PID 2668 wrote to memory of 1444 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 30 PID 1444 wrote to memory of 1240 1444 Crack.exe 21 PID 1444 wrote to memory of 472 1444 Crack.exe 6 PID 1444 wrote to memory of 2904 1444 Crack.exe 32 PID 1444 wrote to memory of 2904 1444 Crack.exe 32 PID 1444 wrote to memory of 2904 1444 Crack.exe 32 PID 1444 wrote to memory of 2904 1444 Crack.exe 32 PID 1444 wrote to memory of 2904 1444 Crack.exe 32 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34 PID 2668 wrote to memory of 2612 2668 ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe 34
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Crack.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Crack.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD521b07ae2fd748d1dfb01482b07e310d0
SHA1fd667e215fde79eacb3d5529dacde0d45c761cd2
SHA25629ff2d4b0d303d4a1bdc574fbf1e9d809de840818787bf57fe2d06389834fd14
SHA512e4058e0fcdddc173a911b6a75ecff6b76b38ac3389022ab1ea1372049134ca981f22a8978cfd1079debfed282ba051e82189ed4dd2f1f7e1d6271d3b3c9f6c68
-
Filesize
948KB
MD53a533dcca9303f34ca71a42edeb4690a
SHA1d2990cfb3879c13d331a96b48fc67b08cc5fb758
SHA256899be7d344e2cfc45372f86ea61f4f4ecd8b3750fae1d2922702f03ec5ea639f
SHA5123c0689e0a83a096f420f0e38a37d5006d8410c34372940b3be38fcfda244ed043142d7410a358a06904dcebbef56e840d11c91fd4f90e637a26df6919fe36c3d
-
Filesize
2KB
MD568b3fd7fe2de5fbf86e524557317fd2d
SHA14424890d38a2512563540b9a63cb8a9e739c0c83
SHA256b761d78717f411ae69e2b4ed7636f9aa98f4b7355eb6944067473732c01ad784
SHA5128d7dacb3bad44572e70374de13294a911510465476b9a73bcfd38a46ca3e9cd1d789bf870d755326ec537f76c06cfaa742b9742d3473aef62b11734dba741c20