Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe
-
Size
100KB
-
MD5
d57c713b81a6271f6384385d7d146bf9
-
SHA1
26389af4c0747902c9035f2d153a214870f89f7f
-
SHA256
64be09d71902d1337fd8f734faf37d501b75b269a0af3ada0da3bad59b8a5349
-
SHA512
517bdc6d31f3f23dc0f96b1f76a6ae524ba4fa137e9c48cede835deb4f17975cfb340decc8164c9bf7ef4999efe4a71f04062ba14c67376a2a11b0412e3980ff
-
SSDEEP
1536:/OxAisOOG+U/Yog91wDJaBel5eoafhjkTs5XRb:wjsOOH/wFrl5eoKhYTsH
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Update = "C:\\Windows\\OLEUpdate.EXE" regedit.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt regedit.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\f:\Autorun.inf d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe File opened for modification \??\f:\Autorun.inf d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\$$$1.reg d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe File created C:\Windows\OLEUpdate.EXE d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe File opened for modification C:\Windows\OLEUpdate.EXE d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe File created C:\Windows\$$$9.reg d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 32 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5c003100000000002359ac2916244d59504943547e310000440008000400efbe2359ac292359ac292a000000280200000000020000000000030000a00000000000004d007900200050006900630074007500720065007300000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 8000310000000000235907301100444f43554d457e310000680008000400efbe2359ac29235907302a000000e90100000000020000000000000000003e000000000044006f00630075006d0065006e0074007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370037003000000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c0031000000000023592430100041646d696e00380008000400efbe2359ac29235924302a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000002359ac291100557365727300600008000400efbeee3a851a2359ac292a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt regedit.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Runs .reg file with regedit 2 IoCs
pid Process 2552 regedit.exe 1740 regedit.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1740 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1740 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1740 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1740 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 30 PID 2008 wrote to memory of 2568 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2568 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2568 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2568 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2552 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 32 PID 2008 wrote to memory of 2552 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 32 PID 2008 wrote to memory of 2552 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 32 PID 2008 wrote to memory of 2552 2008 d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d57c713b81a6271f6384385d7d146bf9_JaffaCakes118.exe"1⤵
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s C:\Windows\$$$1.reg2⤵
- Modifies visibility of file extensions in Explorer
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Runs .reg file with regedit
PID:1740
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe C:\Users\Admin\Documents\My Pictures2⤵PID:2568
-
-
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s C:\Windows\$$$9.reg2⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2552
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2716
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200B
MD5299ab9362ca5106ae0c72eb4ac2adda7
SHA16ad0ae383434486a1fe42ccf0453c53c5c1b1320
SHA2569c39c959f6963f95df88f8fcc1d6651a940615e0ee2faeb422c3bfd5ddfd0b1d
SHA5121d4a6689d1389e521b3827cae88c5a175a157af92a3e667cbfcb4d1a92c60dab7fc9faeebc3f7da5b8542b19fa126fbc05770bcd34238249d15df3fa08e7c02c
-
Filesize
174B
MD582b20cf76f7ea5e316bef622002ed9ba
SHA1c037fe53a55f4e98af0b2dbd496d88587c62cea4
SHA2560c41603de2c858b5749741255a5e50aca1e7f7dde6cd042660c71ebdc9439c88
SHA5124956d42603eb3ce58aeb885444b29083a1e11b9786e4930b80d32e69a47753ac5f7044ebeda9fe1b8c93aa0dd4b880d35f3286cf62fec7d9877374382e3d4d08
-
Filesize
100KB
MD5d57c713b81a6271f6384385d7d146bf9
SHA126389af4c0747902c9035f2d153a214870f89f7f
SHA25664be09d71902d1337fd8f734faf37d501b75b269a0af3ada0da3bad59b8a5349
SHA512517bdc6d31f3f23dc0f96b1f76a6ae524ba4fa137e9c48cede835deb4f17975cfb340decc8164c9bf7ef4999efe4a71f04062ba14c67376a2a11b0412e3980ff
-
Filesize
157B
MD5524e0d91fc238c32eff75837dcebf7d2
SHA1596cc0c5fb80463c4fbc1aa1c58ba701b81d4ccc
SHA2567dbb2534e6b77c87b8ae7ec5ad67b276858d58a931f3bca410b378f9fd0bba89
SHA512d7e226550346f26e571c85aa877829d49a42d4dd12919375d29470e62fcf8f424396de3248ab6401e4a00b916b8534331951f276f737553df9c8c8f30a8895c5