Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe
-
Size
285KB
-
MD5
0f29e077fa0884f247d0a8052b2c5c93
-
SHA1
cf91a1e86e9efe92e0127c1db549b385b8bb0704
-
SHA256
75b9246878a960227a4eed745a2c356d11687572d0dd2b89d5afd60faf6b39a1
-
SHA512
9d5ca93aae220c4ecb75b988dee5bc8f75c92fc6fc969718dd38f453f08353b5c144d8f011b5b40155b4f52460dc066d4aec382845ec2198ed64c27678a5d32e
-
SSDEEP
6144:O9j178jCWXkANmZGceQhAmrf+jTCWdCJqv8+nY:a6jCekoD5QmIaTCWYJqv8+nY
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1224 402C.tmp -
Loads dropped DLL 2 IoCs
pid Process 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\588.exe = "C:\\Program Files (x86)\\LP\\AE08\\588.exe" 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2972-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2972-11-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2600-14-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2972-13-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2600-17-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2600-16-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2972-113-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1492-116-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1492-118-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2972-293-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2972-297-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\AE08\588.exe 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\AE08\588.exe 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\AE08\402C.tmp 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 402C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1720 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 1856 msiexec.exe Token: SeTakeOwnershipPrivilege 1856 msiexec.exe Token: SeSecurityPrivilege 1856 msiexec.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe Token: SeShutdownPrivilege 1720 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe 1720 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2600 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 32 PID 2972 wrote to memory of 2600 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 32 PID 2972 wrote to memory of 2600 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 32 PID 2972 wrote to memory of 2600 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 32 PID 2972 wrote to memory of 1492 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 34 PID 2972 wrote to memory of 1492 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 34 PID 2972 wrote to memory of 1492 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 34 PID 2972 wrote to memory of 1492 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 34 PID 2972 wrote to memory of 1224 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 37 PID 2972 wrote to memory of 1224 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 37 PID 2972 wrote to memory of 1224 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 37 PID 2972 wrote to memory of 1224 2972 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\830E8\269AE.exe%C:\Users\Admin\AppData\Roaming\830E82⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe startC:\Program Files (x86)\E8D0C\lvvm.exe%C:\Program Files (x86)\E8D0C2⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Program Files (x86)\LP\AE08\402C.tmp"C:\Program Files (x86)\LP\AE08\402C.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1224
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1720
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD5b7654023a01a0c2059c519d9bb5b693e
SHA145d886b6c45904f12481e34299957d5a3b9178c5
SHA2564ccae274ecd78e1fdc11a5dcee74d78e01f7656dc6040b2c60d7ded454f321de
SHA512a1f69f37f41651f739734c65c583324b21190becd9c1e0109c3d4fda6b169fa977b928d2d746673b77edbb9e9f08992f4834b113c4a98abebd426ba06dc4ba77
-
Filesize
600B
MD5cc48538a11e8823f090f6a33062fb761
SHA1b5d64d4d7434c83f9b1152bbd51ee59e68f4d041
SHA256f416b8105fd721e01a016e1fac97e6bc2deabfae26e71ab2e00bb8f7b27e221f
SHA512055e80a4a42472db8beae0ea0fbe189b2db2dc639dd9eb7d99effaa97c81fd2ade6b1dc5c856ebbc376115d225c27c8648d702b0f2666ecbab9f4c6fc0ec4055
-
Filesize
1KB
MD543aef15fa308608847eac7029bddfced
SHA15d817282bfbdc76c41f161e64affddb5310db6ff
SHA25656270fb8b04943716db593f69857b4c457df732ee709eefa81449a04f806b5e8
SHA5121d478d1f662f9a156895c8609c123660924841b2681a91125068080bbf074297b6bd0a96dd5dd4a4d95e498113d3d8deb2de7b9d6009c132cac23dd691a35c49
-
Filesize
300B
MD547d32a7fb85bc299533eeec63d987ce1
SHA1de2ddab28186bc7b37921b66c5d1d6d5af87b076
SHA25695f09f829aead8294e663350dd46ece3a485ca2aa035034fca58fb13d0ca94e0
SHA512470a6a8c17efd92dae0c4ebdae5da9656456eb1277f72b77cf887f535a8dacc386fc2ca4fccc8ed2893d46d2d3a88f669a1579f18937ca79d81d2b728fae1051
-
Filesize
100KB
MD550777c38a35804872660aa71c7eb52d2
SHA1c94bdd4378d0e9f0bb2a71edca520bd49251a7aa
SHA25644761b2153a01f2cd930d6b87fc3e2ba09e8940e4d096b556e99c74f26938faa
SHA5120beaa0e126af6adab4867e40fbfe554b829a769bd22af5aad1cfe5f63d569c16c2a003d7b98724efdf8fe255b6c8b124487c999db70c2012ba68faa130fa9ce4