Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 08:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe1e4c1c18acc9b79a142c29a22e6ca4_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
General
-
Target
fe1e4c1c18acc9b79a142c29a22e6ca4_JaffaCakes118.dll
-
Size
136KB
-
MD5
fe1e4c1c18acc9b79a142c29a22e6ca4
-
SHA1
ad19c29ffeb39aa4df47bcd32a620a450d2150ce
-
SHA256
8ad320293c9d12aacbc33004f8996ac8fb6d42bf4eeaa608c7d5b53994a8a7bf
-
SHA512
710ae889eecdb24f2826a0b613cf2546c99abea26fb50fca0f9a865f1c39c897c2e0c1dd94792c6ff6217392bc267bfbf1646914676e27cd2daeaf2ff17eb2fd
-
SSDEEP
3072:6uIIPhvpE6cXjA8iVUAWGaqqqBSpXuWMfujoMITjWS:6/EFpkXsDePGaqqqBmMfujPC
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\qovotnbl\\yunbeqkc.exe" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yunbeqkc.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yunbeqkc.exe svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2668 rundll32mgr.exe 1284 qalvgsmilupjiptg.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc svchost.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power svchost.exe -
Loads dropped DLL 6 IoCs
pid Process 1272 rundll32.exe 1272 rundll32.exe 2668 rundll32mgr.exe 2668 rundll32mgr.exe 2668 rundll32mgr.exe 2668 rundll32mgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\YunBeqkc = "C:\\Users\\Admin\\AppData\\Local\\qovotnbl\\yunbeqkc.exe" svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qalvgsmilupjiptg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe 2844 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2668 rundll32mgr.exe Token: SeDebugPrivilege 2668 rundll32mgr.exe Token: SeSecurityPrivilege 2916 svchost.exe Token: SeSecurityPrivilege 2844 svchost.exe Token: SeDebugPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeSecurityPrivilege 1284 qalvgsmilupjiptg.exe Token: SeLoadDriverPrivilege 1284 qalvgsmilupjiptg.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe Token: SeBackupPrivilege 2844 svchost.exe Token: SeRestorePrivilege 2844 svchost.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 2060 wrote to memory of 1272 2060 rundll32.exe 30 PID 1272 wrote to memory of 2668 1272 rundll32.exe 31 PID 1272 wrote to memory of 2668 1272 rundll32.exe 31 PID 1272 wrote to memory of 2668 1272 rundll32.exe 31 PID 1272 wrote to memory of 2668 1272 rundll32.exe 31 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2916 2668 rundll32mgr.exe 32 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 2844 2668 rundll32mgr.exe 33 PID 2668 wrote to memory of 1284 2668 rundll32mgr.exe 34 PID 2668 wrote to memory of 1284 2668 rundll32mgr.exe 34 PID 2668 wrote to memory of 1284 2668 rundll32mgr.exe 34 PID 2668 wrote to memory of 1284 2668 rundll32mgr.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe1e4c1c18acc9b79a142c29a22e6ca4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe1e4c1c18acc9b79a142c29a22e6ca4_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\qalvgsmilupjiptg.exe"C:\Users\Admin\AppData\Local\Temp\qalvgsmilupjiptg.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD510d2e087710c80d11a2e482cd3a13731
SHA15623e43b4ac7c528449e67bc11cedabe369df54c
SHA256607b206b4baecc7a0be6c0518b8733fb5c4364b7098a262a03befbbfd0d30335
SHA51268b991baad83dc781e8a5ba69d0edfad7e90122618b5c1f178a01a0481a8f43e200cbd7f5702449ec758361ac8f1a1596e7400bd9561a86cbeff31a876a2f65a