Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe
-
Size
698KB
-
MD5
037e013c7f76d47ac65d3e9c1242d15a
-
SHA1
4594047e1b79af17ae32d0bfac82d9dd8a08ba43
-
SHA256
9bb1775ef044a7b860f9f69402ac2ff55e3a3db2003dbf274e344154ec62ec40
-
SHA512
c464cb3488f6cdd82a2fe442341dc767ff64fb66a9dede7a9d0989151339da01bdd7293244a6200999a1024bc65b9b273c2bff993cea013c8142b81d957c97a9
-
SSDEEP
12288:55ndXmyFqwoesw/rDVzLAuiRhsHuZm8S6F3Z4mxxiDqVTVOCv:55ddFqjwdzcfsHMm8pQmX5VTzv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2776 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2840 Hacddfker.com.cn.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Hacddfker.com.cn.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Hacddfker.com.cn.exe 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe File opened for modification C:\Windows\Hacddfker.com.cn.exe 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe File created C:\Windows\uninstal.bat 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hacddfker.com.cn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E}\WpadDecisionTime = 80c5879b8813db01 Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-3d-03-6b-26-f2\WpadDecisionTime = 80c5879b8813db01 Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E} Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E}\WpadDecision = "0" Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Hacddfker.com.cn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Hacddfker.com.cn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-3d-03-6b-26-f2\WpadDetectedUrl Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-3d-03-6b-26-f2\WpadDecisionTime = 00bdcfcc8813db01 Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Hacddfker.com.cn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E}\WpadNetworkName = "Network 3" Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-3d-03-6b-26-f2\WpadDecision = "0" Hacddfker.com.cn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-3d-03-6b-26-f2 Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-3d-03-6b-26-f2\WpadDecisionReason = "1" Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E}\WpadDecisionTime = 00bdcfcc8813db01 Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Hacddfker.com.cn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E}\WpadDecisionReason = "1" Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F5D4FD4F-2F39-4FD7-8907-1D1F1B6F9E0E}\72-3d-03-6b-26-f2 Hacddfker.com.cn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Hacddfker.com.cn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Hacddfker.com.cn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Hacddfker.com.cn.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe Token: SeDebugPrivilege 2840 Hacddfker.com.cn.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 Hacddfker.com.cn.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2244 2840 Hacddfker.com.cn.exe 31 PID 2840 wrote to memory of 2244 2840 Hacddfker.com.cn.exe 31 PID 2840 wrote to memory of 2244 2840 Hacddfker.com.cn.exe 31 PID 2840 wrote to memory of 2244 2840 Hacddfker.com.cn.exe 31 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32 PID 2036 wrote to memory of 2776 2036 037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\037e013c7f76d47ac65d3e9c1242d15a_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uninstal.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\Hacddfker.com.cn.exeC:\Windows\Hacddfker.com.cn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:2244
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
698KB
MD5037e013c7f76d47ac65d3e9c1242d15a
SHA14594047e1b79af17ae32d0bfac82d9dd8a08ba43
SHA2569bb1775ef044a7b860f9f69402ac2ff55e3a3db2003dbf274e344154ec62ec40
SHA512c464cb3488f6cdd82a2fe442341dc767ff64fb66a9dede7a9d0989151339da01bdd7293244a6200999a1024bc65b9b273c2bff993cea013c8142b81d957c97a9
-
Filesize
218B
MD58a8a4e55528e0bed81423e1058006dcd
SHA1f8ac34617a008773b5b92c2d79bb8186c3a98ba9
SHA25607a6cb357756c0b4b081bcf91f3f544b6191897b05092f8b2a959345cc772558
SHA51263ab3aae7736e5f8e691a7ad32dc419f298faee5381779bbcadc263dd720390bc50624b18d3240c730ca0460fdb6539553204f7d259330d4d3b8aecddcd869b8