Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/09/2024, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe
-
Size
164KB
-
MD5
e703bbe47aebe10247b7c5209166eb71
-
SHA1
1bc755041a0ba0324362a82dc483dc7281e439ea
-
SHA256
58078c4f1c7ab58721a954bd519a8b8e5241fb9a146d7e1e8f773046e92f678f
-
SHA512
450c7f57b48a69bae416f62289a96695c952ad0ebd51ef4d108ffd8936bb98304f91b9a505a0e321d44fbb7a97dee3f800e05eca3d22fc807195d6bf71ce55cc
-
SSDEEP
3072:fq7Kl0WdcqBIDkvRyB+n9QorgRyCwuWJ0E32AQH0br1r:SjWxIDkpyE9PwyXJeAQH0brJ
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpdl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdl32.exe = "C:\\Windows\\SysWOW64\\wmpdl32.exe:*:Enabled:Windows Data Launcher" wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpdl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdl32.exe = "C:\\Windows\\SysWOW64\\wmpdl32.exe:*:Enabled:Windows Data Launcher" wmpdl32.exe -
Deletes itself 1 IoCs
pid Process 2852 wmpdl32.exe -
Executes dropped EXE 2 IoCs
pid Process 2384 wmpdl32.exe 2852 wmpdl32.exe -
Loads dropped DLL 3 IoCs
pid Process 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 2384 wmpdl32.exe -
resource yara_rule behavioral1/memory/1692-4-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-7-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-3-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-2-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-8-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-9-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-22-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-34-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-33-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-32-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-38-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-39-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-62-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2852-63-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Data Launcher = "C:\\Windows\\SysWOW64\\wmpdl32.exe" wmpdl32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmpdl32.exe e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpdl32.exe e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdl32.exe File opened for modification C:\Windows\SysWOW64\ e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2584 set thread context of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2384 set thread context of 2852 2384 wmpdl32.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdl32.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 2852 wmpdl32.exe 2852 wmpdl32.exe 2852 wmpdl32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2852 wmpdl32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 2584 wrote to memory of 1692 2584 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2384 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2384 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2384 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 32 PID 1692 wrote to memory of 2384 1692 e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe 32 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2384 wrote to memory of 2852 2384 wmpdl32.exe 33 PID 2852 wrote to memory of 428 2852 wmpdl32.exe 5 PID 2852 wrote to memory of 428 2852 wmpdl32.exe 5 PID 2852 wrote to memory of 256 2852 wmpdl32.exe 1 PID 2852 wrote to memory of 380 2852 wmpdl32.exe 3 PID 2852 wrote to memory of 428 2852 wmpdl32.exe 5 PID 2852 wrote to memory of 476 2852 wmpdl32.exe 6 PID 2852 wrote to memory of 484 2852 wmpdl32.exe 7 PID 2852 wrote to memory of 492 2852 wmpdl32.exe 8 PID 2852 wrote to memory of 600 2852 wmpdl32.exe 9 PID 2852 wrote to memory of 680 2852 wmpdl32.exe 10 PID 2852 wrote to memory of 760 2852 wmpdl32.exe 11 PID 2852 wrote to memory of 824 2852 wmpdl32.exe 12 PID 2852 wrote to memory of 860 2852 wmpdl32.exe 13 PID 2852 wrote to memory of 972 2852 wmpdl32.exe 15 PID 2852 wrote to memory of 276 2852 wmpdl32.exe 16 PID 2852 wrote to memory of 304 2852 wmpdl32.exe 17 PID 2852 wrote to memory of 1056 2852 wmpdl32.exe 18 PID 2852 wrote to memory of 1116 2852 wmpdl32.exe 19 PID 2852 wrote to memory of 1188 2852 wmpdl32.exe 20 PID 2852 wrote to memory of 1284 2852 wmpdl32.exe 21 PID 2852 wrote to memory of 616 2852 wmpdl32.exe 23 PID 2852 wrote to memory of 488 2852 wmpdl32.exe 24 PID 2852 wrote to memory of 916 2852 wmpdl32.exe 25 PID 2852 wrote to memory of 1636 2852 wmpdl32.exe 26 PID 2852 wrote to memory of 2460 2852 wmpdl32.exe 27
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:488
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:916
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:760
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1188
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:304
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1056
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:616
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1636
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2460
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:484
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:492
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e703bbe47aebe10247b7c5209166eb71_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\wmpdl32.exe"C:\Windows\SysWOW64\wmpdl32.exe" C:\Users\Admin\AppData\Local\Temp\E703BB~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\wmpdl32.exe"C:\Windows\SysWOW64\wmpdl32.exe" C:\Users\Admin\AppData\Local\Temp\E703BB~1.EXE5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5e703bbe47aebe10247b7c5209166eb71
SHA11bc755041a0ba0324362a82dc483dc7281e439ea
SHA25658078c4f1c7ab58721a954bd519a8b8e5241fb9a146d7e1e8f773046e92f678f
SHA512450c7f57b48a69bae416f62289a96695c952ad0ebd51ef4d108ffd8936bb98304f91b9a505a0e321d44fbb7a97dee3f800e05eca3d22fc807195d6bf71ce55cc