Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 10:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe
-
Size
76KB
-
MD5
176490eeb06579d38e87ae9420d58baf
-
SHA1
e687b711fdafa7d455729c0c5b8105b9360963f6
-
SHA256
ab934e7c9ac13f178d3ee033579467a6171d13ade679e714b52b8f8f54af55e3
-
SHA512
b14d8725809a32ef905594c485e3fcb6d822e1d65f171d24f536246b35bf30185b755665337124ce6f2d10bf2f61f0017c60b93d65e2e5b8f8e45c840431c3a3
-
SSDEEP
768:9JPHOF3W8nMIbk6KQVEs8rA7FYM9M6Ap9riiJtXbxaEyQkhzyqeIdVVyeoUG79p3:9Jf83W8W60IL26Ap8iJJ3BSeIDIJVpp3
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" Fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" SVIQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" dc.exe -
Executes dropped EXE 3 IoCs
pid Process 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe -
Loads dropped DLL 2 IoCs
pid Process 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" dc.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\Win.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe Fun.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\Penx.dat Fun.exe File created C:\Windows\SysWOW64\WinSit.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe dc.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe dc.exe File opened for modification C:\Windows\SysWOW64\Xpen.dat Fun.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe SVIQ.EXE -
Drops file in Windows directory 34 IoCs
description ioc Process File created C:\Windows\inf\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\Help\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\dc.exe dc.exe File created C:\Windows\SVIQ.EXE dc.exe File opened for modification C:\Windows\Help\Other.exe dc.exe File opened for modification C:\Windows\SVIQ.exe SVIQ.EXE File opened for modification C:\Windows\dc.exe SVIQ.EXE File opened for modification C:\Windows\inf\Other.exe dc.exe File opened for modification C:\Windows\dc.exe dc.exe File created C:\Windows\SVIQ.EXE 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SVIQ.EXE 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe Fun.exe File opened for modification C:\Windows\Help\Other.exe SVIQ.EXE File created C:\Windows\system\Fun.exe dc.exe File created C:\Windows\dc.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\dc.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\Help\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\SVIQ.EXE Fun.exe File opened for modification C:\Windows\Help\Other.exe Fun.exe File opened for modification C:\Windows\inf\Other.exe SVIQ.EXE File opened for modification C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\inf\Other.exe Fun.exe File opened for modification C:\Windows\wininit.ini SVIQ.EXE File opened for modification C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\wininit.ini 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File created C:\Windows\system\Fun.exe Fun.exe File created C:\Windows\SVIQ.EXE SVIQ.EXE File created C:\Windows\system\Fun.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\system\Fun.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\inf\Other.exe 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe File opened for modification C:\Windows\wininit.ini Fun.exe File created C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\wininit.ini dc.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVIQ.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe 2860 SVIQ.EXE 2792 dc.exe 2708 Fun.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 2708 Fun.exe 2708 Fun.exe 2860 SVIQ.EXE 2860 SVIQ.EXE 2792 dc.exe 2792 dc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2708 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 30 PID 2516 wrote to memory of 2708 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 30 PID 2516 wrote to memory of 2708 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 30 PID 2516 wrote to memory of 2708 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2860 2708 Fun.exe 31 PID 2708 wrote to memory of 2860 2708 Fun.exe 31 PID 2708 wrote to memory of 2860 2708 Fun.exe 31 PID 2708 wrote to memory of 2860 2708 Fun.exe 31 PID 2516 wrote to memory of 2792 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 32 PID 2516 wrote to memory of 2792 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 32 PID 2516 wrote to memory of 2792 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 32 PID 2516 wrote to memory of 2792 2516 176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\176490eeb06579d38e87ae9420d58baf_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SVIQ.EXEC:\Windows\SVIQ.EXE3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
-
C:\Windows\dc.exeC:\Windows\dc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5176490eeb06579d38e87ae9420d58baf
SHA1e687b711fdafa7d455729c0c5b8105b9360963f6
SHA256ab934e7c9ac13f178d3ee033579467a6171d13ade679e714b52b8f8f54af55e3
SHA512b14d8725809a32ef905594c485e3fcb6d822e1d65f171d24f536246b35bf30185b755665337124ce6f2d10bf2f61f0017c60b93d65e2e5b8f8e45c840431c3a3
-
Filesize
41B
MD5e839977c0d22c9aa497b0b1d90d8a372
SHA1b5048e501399138796b38f3d3666e1a88c397e83
SHA256478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2
SHA5124c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d