Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe
-
Size
198KB
-
MD5
13e42b0bcd4ec6702d2ff4ce5f5b1ccd
-
SHA1
cdbb772997cd8f79b889ad790b1a3e326ae69b1b
-
SHA256
82029f82fde8b78c4b0313a58d89c32a078fc18f565cc4ebc4b0ab30d340b675
-
SHA512
e773fcc81d6a547f9910c107a47e6edeedfa5666397a26e2ca0f9a25b471ab247e8545d44949ab87263d5a30fd2c707af0fd8fa33f3b041529a73f10a2ecd949
-
SSDEEP
3072:fBivIGKtx6KXqK5hLkYX9aZCwFNEFQCqqXsUNq4WXeY6+vvDDRrs+eq:UIGK/EKLnuCwzFUNqhOYzt
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1336 cmd.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 2 IoCs
pid Process 1192 Explorer.EXE 476 services.exe -
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3044 set thread context of 1336 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\clsid 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-312935884-697965778-3955649944-1000\\$13dae7fa63ea489d4dbbfe46431825e3\\n." 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$13dae7fa63ea489d4dbbfe46431825e3\\n." 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 476 services.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Token: SeDebugPrivilege 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Token: SeDebugPrivilege 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe Token: SeDebugPrivilege 476 services.exe Token: SeBackupPrivilege 476 services.exe Token: SeRestorePrivilege 476 services.exe Token: SeSecurityPrivilege 476 services.exe Token: SeTakeOwnershipPrivilege 476 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1192 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 21 PID 3044 wrote to memory of 1192 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 21 PID 3044 wrote to memory of 476 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 6 PID 3044 wrote to memory of 1336 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 31 PID 3044 wrote to memory of 1336 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 31 PID 3044 wrote to memory of 1336 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 31 PID 3044 wrote to memory of 1336 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 31 PID 3044 wrote to memory of 1336 3044 13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe 31
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:476
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\13e42b0bcd4ec6702d2ff4ce5f5b1ccd_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1336
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a091a65820a19a7002a2e91dc520b959
SHA1381c8d5c8f39d482e83b0fbbf60f8923921fb28e
SHA256dd27a656704f65b4ddf1d1445b1d695e14d942e90f13c98d91d0f087d4714f67
SHA512f2d0cb6eb51ab8a11225cdbd68e9d05103feefefffbe440bef4dbba152375ea9a9b8dbc5532c2e857719ee687d0d651ac0e7bea1f2a4740e483a84ad2bd15681
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2