Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 15:56
Behavioral task
behavioral1
Sample
f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe
-
Size
372KB
-
MD5
f65ab7cd6edd0e28e8af9283246b30a8
-
SHA1
40de8a9cf006d6f73ccd5ff992ec857fc3840817
-
SHA256
c2aee86483687e5cc13f93b24746a76d362f23ce57096802e83bb82c66983789
-
SHA512
202299e5e28544833830a20b8a71b146f6b0fb0905c262c3550acb5f522679d931ea157317b2fb6b5fe86dc8a9ee549696f263bfc8154a2502544c4f51fbc2a9
-
SSDEEP
6144:eG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcJ:p7kmAN6omFMb3sGB6UduRfLaJ
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51FDA1B9-F6A8-3F38-C3BD-D2D2F5ACAAA4} f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51FDA1B9-F6A8-3F38-C3BD-D2D2F5ACAAA4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe" f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{51FDA1B9-F6A8-3F38-C3BD-D2D2F5ACAAA4} f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{51FDA1B9-F6A8-3F38-C3BD-D2D2F5ACAAA4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe" f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-7-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-9-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-13-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-16-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-19-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-23-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-26-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-29-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-32-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-36-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-39-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-43-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral2/memory/3492-46-0x0000000000400000-0x000000000045E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2336 reg.exe 3340 reg.exe 1536 reg.exe 3972 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeCreateTokenPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeLockMemoryPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeMachineAccountPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeTcbPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeSecurityPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeSystemtimePrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeBackupPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeRestorePrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeShutdownPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeDebugPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeAuditPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeUndockPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeSyncAgentPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeManageVolumePrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeImpersonatePrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: 31 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: 32 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: 33 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: 34 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: 35 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe Token: SeDebugPrivilege 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3552 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 82 PID 3492 wrote to memory of 3552 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 82 PID 3492 wrote to memory of 3552 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 82 PID 3492 wrote to memory of 1492 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 83 PID 3492 wrote to memory of 1492 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 83 PID 3492 wrote to memory of 1492 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 83 PID 3492 wrote to memory of 1760 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 84 PID 3492 wrote to memory of 1760 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 84 PID 3492 wrote to memory of 1760 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 84 PID 3492 wrote to memory of 4452 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 85 PID 3492 wrote to memory of 4452 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 85 PID 3492 wrote to memory of 4452 3492 f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe 85 PID 3552 wrote to memory of 2336 3552 cmd.exe 90 PID 3552 wrote to memory of 2336 3552 cmd.exe 90 PID 3552 wrote to memory of 2336 3552 cmd.exe 90 PID 1492 wrote to memory of 1536 1492 cmd.exe 91 PID 1492 wrote to memory of 1536 1492 cmd.exe 91 PID 1492 wrote to memory of 1536 1492 cmd.exe 91 PID 1760 wrote to memory of 3340 1760 cmd.exe 92 PID 1760 wrote to memory of 3340 1760 cmd.exe 92 PID 1760 wrote to memory of 3340 1760 cmd.exe 92 PID 4452 wrote to memory of 3972 4452 cmd.exe 93 PID 4452 wrote to memory of 3972 4452 cmd.exe 93 PID 4452 wrote to memory of 3972 4452 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f65ab7cd6edd0e28e8af9283246b30a8_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1536
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3340
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3972
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1