Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe
-
Size
94KB
-
MD5
0f15908396c9f4c795cfac006a28875b
-
SHA1
4b0d4a2df586d50c2f9670919b89b87a8611d0ae
-
SHA256
a47172dffe9f232c1a41fa483b7e472413222bafc0c56aa465fe217010b7b10c
-
SHA512
d276b1a6e808c45da1bfa462dea31086771e3972d5379694cf8b2caeb92809ebf6f2c2e92451c5b7f9563833afaf85c07b05130dd8150d1a4dda29b3f17b68d7
-
SSDEEP
1536:TPnxJB3+r3eAwMIQEfGA5863NiA3Zymv6t8ZQEfGA5863NiA3Zymv6t87:r9O71TIGA58giKZyijGA58giKZyiN
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\eta\hosts 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2784 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2784 cmd.exe 2864 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2400 taskkill.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IE\ = "IE" 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "????" 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE $" 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IE 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\NeverShowExt = "1" 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2864 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Token: SeDebugPrivilege 2400 taskkill.exe Token: SeDebugPrivilege 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Token: SeDebugPrivilege 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Token: SeDebugPrivilege 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe Token: SeDebugPrivilege 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2400 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 30 PID 2124 wrote to memory of 2400 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 30 PID 2124 wrote to memory of 2400 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 30 PID 2124 wrote to memory of 2400 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 30 PID 2124 wrote to memory of 2784 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 33 PID 2124 wrote to memory of 2784 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 33 PID 2124 wrote to memory of 2784 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 33 PID 2124 wrote to memory of 2784 2124 0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe 33 PID 2784 wrote to memory of 2864 2784 cmd.exe 36 PID 2784 wrote to memory of 2864 2784 cmd.exe 36 PID 2784 wrote to memory of 2864 2784 cmd.exe 36 PID 2784 wrote to memory of 2864 2784 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ZhuDongFangyu.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 1 && del "C:\Users\Admin\AppData\Local\Temp\0f15908396c9f4c795cfac006a28875b_JaffaCakes118.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2864
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1