Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 21:28
Behavioral task
behavioral1
Sample
14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe
-
Size
298KB
-
MD5
14f9c99a50f15f6359127149fa8da940
-
SHA1
e722e8ed4b2b1bf4aabaeb56622e78aed189eb1d
-
SHA256
b688ea20621c4ddd8853cb220aefb08f9124ed66e987cf68fd214accd05baaf3
-
SHA512
c57093462ddf514f68845ca51b36956d0df2119297900a6aa4983d7dc89b5fcf5ef1686a977888bcbf444f87d3180ec1f32e5ddc74120cc19e629aa42d11aaf9
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIY3:v6Wq4aaE6KwyF5L0Y2D1PqL8
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\b: svhost.exe -
AutoIT Executable 17 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2948-6-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1756-688-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-1043-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-1156-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-2294-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-3439-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-4573-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-5714-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-6859-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-7889-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-9027-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-10180-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-11322-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-12478-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-13628-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-14652-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2948-15793-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/1756-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x001500000000f6b0-7.dat upx behavioral1/memory/2948-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x0007000000018dea-67.dat upx behavioral1/memory/1756-688-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-1043-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-1156-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-2294-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-3439-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-4573-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-5714-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-6859-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-7889-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-9027-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-10180-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-11322-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-12478-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-13628-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-14652-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2948-15793-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2948 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe 2948 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2948 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 29 PID 1756 wrote to memory of 2948 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 29 PID 1756 wrote to memory of 2948 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 29 PID 1756 wrote to memory of 2948 1756 14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14f9c99a50f15f6359127149fa8da940_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5310b99e7317d2fd9c4d2fc8355652cf2
SHA11c2b8ecb17c4aa3074c025d58ade5fb9022af63c
SHA256e2eb2ad6de2321c5568a9b3fd4b78a0a05186b5ab2f10b44b3d8c0e24ae29f4b
SHA512dd5edf788a8dc1ea2366b35967b6ba8e48b23c70958c8bd882d4fe0155f21a0c3134a0ba3436f17a66ababb6e41e506607d82bce56da18f1fa5c99bf1e89b16a
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5c67fa00b986a8003f183b97e98eddffc
SHA11fcd53182bd27c7261a3936019a9b962b2a41116
SHA256be1e2e0cb3a1f59b93c15bcd8ef6c3af969c6c44b98dfcfa7556f7842199b621
SHA512e9e0b134ca10d31b6c33989636d787c9c4b42c452ea415339811f7f997ec99650f89ed8a5f09dc3be636168278685746aa36fe059d83ba33069e2925cbe47b43