Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
07c3493d1432f925f8d6d006e125530a
-
SHA1
a03c3d303c82e22cf8dc936049cf07d5059d8ff5
-
SHA256
91e48959cf21cd7d0d11b048d5999fd6a52324b676538f1369cb489bbdd1742d
-
SHA512
3934aa538a88e858d108d960901a9952e50ddfad22245a5670427739f2890790e13e944cb6ea5eaac3a745b72a296057b29109e9ce7e08eb1b66c876758a1591
-
SSDEEP
24576:LSihcj6jBSt/PHuuZSd4TxydEBv6iKnPWp5pGpLeYGqr+4cvJK+xlzlVNm:Lv/
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Barra de Busca do Google = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Media Player\\GoogleToolbarNotifier.exe" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1744 set thread context of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe -
Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "0" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "0" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnCloseAdvanced = "0" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\AutoCompleteGroups = "4" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\New Windows\PopupMgr = "no" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\AlwaysShowMenus = "1" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LinksBar\Enabled = "0" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAdjacent = "1" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "2" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\New Windows 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LinksBar 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "1" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\UseHomepageForNewTab = "1" 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 672 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29 PID 1744 wrote to memory of 672 1744 07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\07c3493d1432f925f8d6d006e125530a_JaffaCakes118.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Automatic Crash Recovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:672
-