Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
eb7ce4c94f8c940ff49610913a1d4122_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
eb7ce4c94f8c940ff49610913a1d4122_JaffaCakes118.dll
-
Size
120KB
-
MD5
eb7ce4c94f8c940ff49610913a1d4122
-
SHA1
f44a8a7a103b4d2dec350a3802c0aa0d3c6bbe4b
-
SHA256
05abd9736c6262d5f17972836dd4d23b1363375ca913567e957155f1b080a492
-
SHA512
fd4599b1aef47866a63ac964530c301f8a19e540e68e5b5cd6d2c00aef5204c602cff9b3314d467adfa7da08d10076984ac3766f695da21b0097fcb3c6d0dabb
-
SSDEEP
1536:dQB7sFY1SSb5hK39c4vX5zPIwqvtEEXJzJY2+Sjlobod489isPr2tyK:dQB7Dk66BP0vKEXM2+Sjloboj9isTO
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76ae97.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b0f7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b0f7.exe -
Executes dropped EXE 3 IoCs
pid Process 2988 f76ae97.exe 2264 f76b0f7.exe 2644 f76cf02.exe -
Loads dropped DLL 6 IoCs
pid Process 2084 rundll32.exe 2084 rundll32.exe 2084 rundll32.exe 2084 rundll32.exe 2084 rundll32.exe 2084 rundll32.exe -
resource yara_rule behavioral1/memory/2988-14-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-18-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-22-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-16-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-20-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-24-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-23-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-21-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-19-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-60-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-61-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-66-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-67-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-68-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-70-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-72-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-73-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-74-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-90-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-91-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2988-156-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2264-158-0x0000000000A00000-0x0000000001ABA000-memory.dmp upx behavioral1/memory/2264-162-0x0000000000A00000-0x0000000001ABA000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b0f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b0f7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ae97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b0f7.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: f76ae97.exe File opened (read-only) \??\M: f76ae97.exe File opened (read-only) \??\N: f76ae97.exe File opened (read-only) \??\S: f76ae97.exe File opened (read-only) \??\G: f76ae97.exe File opened (read-only) \??\L: f76ae97.exe File opened (read-only) \??\H: f76ae97.exe File opened (read-only) \??\I: f76ae97.exe File opened (read-only) \??\K: f76ae97.exe File opened (read-only) \??\Q: f76ae97.exe File opened (read-only) \??\R: f76ae97.exe File opened (read-only) \??\T: f76ae97.exe File opened (read-only) \??\E: f76ae97.exe File opened (read-only) \??\O: f76ae97.exe File opened (read-only) \??\P: f76ae97.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76ffd2 f76b0f7.exe File created C:\Windows\f76aef5 f76ae97.exe File opened for modification C:\Windows\SYSTEM.INI f76ae97.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76ae97.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2988 f76ae97.exe 2988 f76ae97.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe Token: SeDebugPrivilege 2988 f76ae97.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2508 wrote to memory of 2084 2508 rundll32.exe 30 PID 2084 wrote to memory of 2988 2084 rundll32.exe 31 PID 2084 wrote to memory of 2988 2084 rundll32.exe 31 PID 2084 wrote to memory of 2988 2084 rundll32.exe 31 PID 2084 wrote to memory of 2988 2084 rundll32.exe 31 PID 2988 wrote to memory of 1104 2988 f76ae97.exe 19 PID 2988 wrote to memory of 1160 2988 f76ae97.exe 20 PID 2988 wrote to memory of 1192 2988 f76ae97.exe 21 PID 2988 wrote to memory of 1388 2988 f76ae97.exe 23 PID 2988 wrote to memory of 2508 2988 f76ae97.exe 29 PID 2988 wrote to memory of 2084 2988 f76ae97.exe 30 PID 2988 wrote to memory of 2084 2988 f76ae97.exe 30 PID 2084 wrote to memory of 2264 2084 rundll32.exe 32 PID 2084 wrote to memory of 2264 2084 rundll32.exe 32 PID 2084 wrote to memory of 2264 2084 rundll32.exe 32 PID 2084 wrote to memory of 2264 2084 rundll32.exe 32 PID 2084 wrote to memory of 2644 2084 rundll32.exe 34 PID 2084 wrote to memory of 2644 2084 rundll32.exe 34 PID 2084 wrote to memory of 2644 2084 rundll32.exe 34 PID 2084 wrote to memory of 2644 2084 rundll32.exe 34 PID 2988 wrote to memory of 1104 2988 f76ae97.exe 19 PID 2988 wrote to memory of 1160 2988 f76ae97.exe 20 PID 2988 wrote to memory of 1192 2988 f76ae97.exe 21 PID 2988 wrote to memory of 1388 2988 f76ae97.exe 23 PID 2988 wrote to memory of 2264 2988 f76ae97.exe 32 PID 2988 wrote to memory of 2264 2988 f76ae97.exe 32 PID 2988 wrote to memory of 2644 2988 f76ae97.exe 34 PID 2988 wrote to memory of 2644 2988 f76ae97.exe 34 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b0f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ae97.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb7ce4c94f8c940ff49610913a1d4122_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb7ce4c94f8c940ff49610913a1d4122_JaffaCakes118.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\f76ae97.exeC:\Users\Admin\AppData\Local\Temp\f76ae97.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\f76b0f7.exeC:\Users\Admin\AppData\Local\Temp\f76b0f7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\f76cf02.exeC:\Users\Admin\AppData\Local\Temp\f76cf02.exe4⤵
- Executes dropped EXE
PID:2644
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD51d822be6ad560b63f58066a08b9b70b7
SHA1157817c90e9298866c8a9234eaf85ecc5cc32c80
SHA25696219ffec394354b9c40c00d1ab0c3be168845b8457932ceba53edb4703f917f
SHA512dbff654431e35942409a187f045473540eab81c67a0668ea554ed9dcd5f9a11a86f5144cd0ce511166e31781f47d35fbd0a02acd87d64a287a4e6b9e1cb5fcc8