Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe
-
Size
872KB
-
MD5
de3ba2efe286a53569748217fb295c54
-
SHA1
c82d36a49a31a4a3a98487cc263827bd5b4bcc15
-
SHA256
9c7956af921d0d46577983d35f4f00e0dcd1c786ab6ce5a59a10247d6b74cfd6
-
SHA512
a3d3b804ea2d742d82eb5ba328150d370a6988ca4fa53cdf9e6170f03178b676a1c8a79b0ddf053ca0a19061eb920422f96bee5c7e5cc012d33b98fbb2a4ec44
-
SSDEEP
12288:Va84Rvv+ADxRmUKpTvJSIP4j0XlhYcfbSkI6mkGRLV/CG9sRmci/:VEvzRqTMG4H4ukwFCGWgcS
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winupdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{404B3AFF-DFF5-81BB-FDD9-CA9DB2E1BBFC} de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{404B3AFF-DFF5-81BB-FDD9-CA9DB2E1BBFC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{404B3AFF-DFF5-81BB-FDD9-CA9DB2E1BBFC} de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{404B3AFF-DFF5-81BB-FDD9-CA9DB2E1BBFC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2364-2-0x0000000000400000-0x0000000000529000-memory.dmp upx behavioral2/memory/2364-5-0x0000000000400000-0x0000000000529000-memory.dmp upx behavioral2/memory/2364-10-0x0000000000400000-0x0000000000529000-memory.dmp upx behavioral2/memory/2364-8-0x0000000000400000-0x0000000000529000-memory.dmp upx behavioral2/memory/2364-6-0x0000000000400000-0x0000000000529000-memory.dmp upx behavioral2/memory/2364-13-0x0000000000400000-0x0000000000529000-memory.dmp upx behavioral2/memory/2364-18-0x0000000000400000-0x0000000000529000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1688 set thread context of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 set thread context of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2812 reg.exe 3128 reg.exe 264 reg.exe 4092 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2364 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 2364 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeCreateTokenPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeLockMemoryPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeMachineAccountPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeTcbPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeSecurityPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeSystemtimePrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeBackupPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeRestorePrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeShutdownPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeDebugPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeAuditPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeUndockPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeSyncAgentPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeManageVolumePrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeImpersonatePrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: 31 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: 32 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: 33 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: 34 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: 35 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe Token: SeDebugPrivilege 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 2364 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 83 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 1688 wrote to memory of 3384 1688 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 84 PID 3384 wrote to memory of 2980 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 86 PID 3384 wrote to memory of 2980 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 86 PID 3384 wrote to memory of 2980 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 86 PID 3384 wrote to memory of 1792 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 87 PID 3384 wrote to memory of 1792 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 87 PID 3384 wrote to memory of 1792 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 87 PID 3384 wrote to memory of 4928 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 88 PID 3384 wrote to memory of 4928 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 88 PID 3384 wrote to memory of 4928 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 88 PID 3384 wrote to memory of 3164 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 89 PID 3384 wrote to memory of 3164 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 89 PID 3384 wrote to memory of 3164 3384 de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe 89 PID 2980 wrote to memory of 3128 2980 cmd.exe 94 PID 2980 wrote to memory of 3128 2980 cmd.exe 94 PID 2980 wrote to memory of 3128 2980 cmd.exe 94 PID 1792 wrote to memory of 264 1792 cmd.exe 95 PID 1792 wrote to memory of 264 1792 cmd.exe 95 PID 1792 wrote to memory of 264 1792 cmd.exe 95 PID 3164 wrote to memory of 4092 3164 cmd.exe 96 PID 3164 wrote to memory of 4092 3164 cmd.exe 96 PID 3164 wrote to memory of 4092 3164 cmd.exe 96 PID 4928 wrote to memory of 2812 4928 cmd.exe 97 PID 4928 wrote to memory of 2812 4928 cmd.exe 97 PID 4928 wrote to memory of 2812 4928 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3128
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\de3ba2efe286a53569748217fb295c54_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:264
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2812
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winupdate.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winupdate.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4092
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1