Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe
-
Size
314KB
-
MD5
0f1aa5f6fd74c362e0921ec29398a43e
-
SHA1
627cff04e9b812394c3569ee4e9ff98e5f5025bc
-
SHA256
b44ac5d876a27677c138df4c57500613590573e36ea89c7074d94869571ec9c6
-
SHA512
b36e077cdb8b0e24ae4e62b3be075fc180756ada06062dac2567a5794c27e55a8b00daf524a3994512d2229dd0d8110cb5a0ad0151bb2b873e837091cc8b16eb
-
SSDEEP
6144:sGUfAWA+GdPAbt51c+2INc0oQjrzhe4NEZ18SGDZR/nBJJHzg0Vrmx:AfA+GdPeL1BlcbQj39GZiSGDZR/LJ00V
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2784 4116.tmp -
Loads dropped DLL 2 IoCs
pid Process 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D5E.exe = "C:\\Program Files (x86)\\LP\\3270\\D5E.exe" 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2916-3-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2916-13-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2916-15-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1388-16-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1388-17-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2916-142-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/680-144-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/680-146-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2916-324-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2916-341-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2916-345-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\3270\D5E.exe 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\3270\D5E.exe 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\3270\4116.tmp 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4116.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2440 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 472 msiexec.exe Token: SeTakeOwnershipPrivilege 472 msiexec.exe Token: SeSecurityPrivilege 472 msiexec.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe Token: SeShutdownPrivilege 2440 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2916 wrote to memory of 1388 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 32 PID 2916 wrote to memory of 1388 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 32 PID 2916 wrote to memory of 1388 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 32 PID 2916 wrote to memory of 1388 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 32 PID 2916 wrote to memory of 680 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 34 PID 2916 wrote to memory of 680 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 34 PID 2916 wrote to memory of 680 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 34 PID 2916 wrote to memory of 680 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 34 PID 2916 wrote to memory of 2784 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 37 PID 2916 wrote to memory of 2784 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 37 PID 2916 wrote to memory of 2784 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 37 PID 2916 wrote to memory of 2784 2916 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\0BA59\49232.exe%C:\Users\Admin\AppData\Roaming\0BA592⤵
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe startC:\Program Files (x86)\590E5\lvvm.exe%C:\Program Files (x86)\590E52⤵
- System Location Discovery: System Language Discovery
PID:680
-
-
C:\Program Files (x86)\LP\3270\4116.tmp"C:\Program Files (x86)\LP\3270\4116.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:472
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2440
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD513d73bc73d974c09a4910fbb561ecacc
SHA121b30b4c2100c966a53d7e8dcd7835831c916c91
SHA256e293782cf2092d38b4cb6cfd4afad259258a5d1c8b12862837d7ead2c8748bb8
SHA5126675a0e65a56cb8430c2ece984a6a4785e043418e97cab000ef37ef0302da56e3a0d701d0dcadafbc5316f50a69e8cff92585f787d7e8fc5de117d7344d64235
-
Filesize
600B
MD505471da83f0441b3c46b871172174232
SHA15b3c4b7d5797063c15c8f61aa7f826f805c430dd
SHA25609c8aa38fdf37fd3f0f688b31cba1df6bb0c995edb48c95c07b10506129798eb
SHA512968731973fe5ec8dd9af7dc8f47d5fb73e4cf9833d7ae1d08ef2d3d6a85506d769541ac50bd060735bbb9265ef2fbd5e10bf69ee639d0b7521a7e486d120afbb
-
Filesize
1KB
MD5ffd60a27d65b3b54f3c3e776c0c89372
SHA15fc213df6bfb984b30ba850f13a8077006b9c6a1
SHA2562cf109e2c1ef6f5a1d6a54a073c52a2e49422b45acd5d7001d9039a9bae4043c
SHA51299e94c329a8331fbcb42fd3b11245c60d5c9378e4d52d6929b76b477739ffa1a20c92b208769af0bc05edaf5c4a39aec5cb00aa45c0ba08e65e66966bab8382b
-
Filesize
106KB
MD5935d252de43cc52d42d8c5fdc7676106
SHA1966be71764ce145763aec024eb68448fb1981a99
SHA2568aa995d7637c52067ca57bc7017c2279ab7b427d55634ef5effab4bf2d9e9807
SHA512dfbf507852bb7771a6d56b35ece4e1391ab56f7d3501ffb1f452b5acbf1c6faf76b6607893c96ee0663c1dd25f85dbece3a32aee52225ec09b8ee3db6440886b