Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 00:38
Behavioral task
behavioral1
Sample
157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe
-
Size
960KB
-
MD5
157ecd0bbfe6b65910880f7f9a374019
-
SHA1
38828088dbf1992e52fa299b95d7e03f13068e56
-
SHA256
bd8fae1dd44c85dbe490de39bbf362e62b5d05e09b8d5cfabf92964b958226d7
-
SHA512
3f1bb5d5fd853ea4edf219e6fb11dafa359baecf44a313681246bf7e05c47b1a1d9f315f9da403106df6b95dd7d178f33f5360178e7fe0401ba31059840c8c35
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Ye:1thEVaPqLBthEVaPqLHthEVaPqLTthE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2808 svhost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2808-6-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2728-687-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2808-1098-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2728-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x000c000000017444-4.dat upx behavioral1/memory/2808-6-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x00170000000185f5-66.dat upx behavioral1/memory/2728-687-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2808-1098-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2808 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe 2808 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2808 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 30 PID 2728 wrote to memory of 2808 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 30 PID 2728 wrote to memory of 2808 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 30 PID 2728 wrote to memory of 2808 2728 157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\157ecd0bbfe6b65910880f7f9a374019_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD510687ffd94899c9d850bc50ba6e66af3
SHA1f3e6ce603e04bf8e371dd90472d8bf2f82068e29
SHA2562ce5110fbb9d13b0e4e5cbc91db6d6593c8ba53d2ffc9f38bf770dee68720a26
SHA5127536b7dfdd3576bb7136ab5eeaf8ebaf441c04c1f30e4c3144581aaa7d99174345d2cb088f8d932a24fe1e67f056e6229b2daad50f525d51ea1c90771f16e688
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD515680352dd8b1099885247f63042a194
SHA181c8ae118c477ddf5e745e969e38748fe7984889
SHA256444f60ada5b5afeb149c5470403ed705f51c08adb11f0ac6c827e5fdf7160317
SHA51261f1ab09e28471de1426de55d6926142978805e6bd8c5a32f1859f3beb9411f0a3a5e40d3d015b0a4db90118806ff399305bf5b4e81f9452acc6ead162a7eb13