Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
e254e83899db63edd94362d3694ae647_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
e254e83899db63edd94362d3694ae647_JaffaCakes118.exe
-
Size
73KB
-
MD5
e254e83899db63edd94362d3694ae647
-
SHA1
bccf2d460dae96a766d2978c4a5178e654e80dd8
-
SHA256
52633981af075259928529e089741f226aefb674c179982d1c45276c27e3667e
-
SHA512
b973848eccb726eaca1c9600493e91e4ab4d8ab8526dc4b0d2d1af09570cdefaae12930b84f2c56cb73306ce6cc663ef69d592899cecd8b5bc045a38576f9e40
-
SSDEEP
1536:p4MEpRNE4FMmRWEcT4YRFYNE3C4SIE/147M1gRQ/ESEhtRPDqIR844EiRr4WMkRN:p4MEpRNE4FMmRWEcT4YRFYNE3C4DE/1U
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat serslide.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language serslide.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language serslide.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e254e83899db63edd94362d3694ae647_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e254e83899db63edd94362d3694ae647_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier serslide.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier serslide.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad serslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings serslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 serslide.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix serslide.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" serslide.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" serslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" serslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 serslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0132000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 serslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-7e-55-7d-b6-62 serslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BB44DCA1-8378-4728-88F9-1C5E44C3A528}\6a-7e-55-7d-b6-62 serslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-7e-55-7d-b6-62\WpadDecisionTime = 803c7dd85e07db01 serslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BB44DCA1-8378-4728-88F9-1C5E44C3A528}\WpadDecision = "0" serslide.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BB44DCA1-8378-4728-88F9-1C5E44C3A528}\WpadNetworkName = "Network 3" serslide.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections serslide.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BB44DCA1-8378-4728-88F9-1C5E44C3A528} serslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BB44DCA1-8378-4728-88F9-1C5E44C3A528}\WpadDecisionReason = "1" serslide.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings serslide.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BB44DCA1-8378-4728-88F9-1C5E44C3A528}\WpadDecisionTime = 803c7dd85e07db01 serslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-7e-55-7d-b6-62\WpadDecisionReason = "1" serslide.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6a-7e-55-7d-b6-62\WpadDecision = "0" serslide.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2780 serslide.exe 2780 serslide.exe 2780 serslide.exe 2780 serslide.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2676 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2676 2636 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2676 2636 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2676 2636 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2676 2636 e254e83899db63edd94362d3694ae647_JaffaCakes118.exe 30 PID 2936 wrote to memory of 2780 2936 serslide.exe 32 PID 2936 wrote to memory of 2780 2936 serslide.exe 32 PID 2936 wrote to memory of 2780 2936 serslide.exe 32 PID 2936 wrote to memory of 2780 2936 serslide.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e254e83899db63edd94362d3694ae647_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e254e83899db63edd94362d3694ae647_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\e254e83899db63edd94362d3694ae647_JaffaCakes118.exe--7f25830d2⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: RenamesItself
PID:2676
-
-
C:\Windows\SysWOW64\serslide.exe"C:\Windows\SysWOW64\serslide.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\serslide.exe--a97bf3c32⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2780
-