Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 23:13
Behavioral task
behavioral1
Sample
1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe
-
Size
342KB
-
MD5
1a390ce9a38656bacbab2c736b376086
-
SHA1
8ed6c5c558ccef8562e9b414efc258933e60ea6f
-
SHA256
c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa
-
SHA512
a42b3754c2e1ebba6c2cbae61825243f93c3d1322c08c924003a53af10c9fbc9c0f9d07854dae9a1cffe2ea99986cdb0250c6c9989abbd65c8c6c7d7eaf44a8a
-
SSDEEP
6144:9Rqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yXoQHtVee:DqmpplpGoGL3etQoMiXM8gxf/Sj4yXlu
Malware Config
Extracted
latentbot
lesperez1337.zapto.org
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe -
resource yara_rule behavioral1/files/0x0013000000017553-28.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 308 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2736 fservice.exe 1912 services.exe -
Loads dropped DLL 6 IoCs
pid Process 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 1912 services.exe 1912 services.exe 2736 fservice.exe 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe -
resource yara_rule behavioral1/memory/2784-0-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/files/0x000c000000017444-6.dat upx behavioral1/memory/2784-13-0x0000000003040000-0x000000000323C000-memory.dmp upx behavioral1/memory/1912-25-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2736-45-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/2784-48-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-51-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-53-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-55-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-57-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-59-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-61-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-63-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-65-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-67-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-69-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-71-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-73-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-75-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-77-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral1/memory/1912-79-0x0000000000400000-0x00000000005FC000-memory.dmp upx -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system\sservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fservice.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe 1912 services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1912 services.exe 1912 services.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2736 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 30 PID 2784 wrote to memory of 2736 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 30 PID 2784 wrote to memory of 2736 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 30 PID 2784 wrote to memory of 2736 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 30 PID 2736 wrote to memory of 1912 2736 fservice.exe 31 PID 2736 wrote to memory of 1912 2736 fservice.exe 31 PID 2736 wrote to memory of 1912 2736 fservice.exe 31 PID 2736 wrote to memory of 1912 2736 fservice.exe 31 PID 1912 wrote to memory of 2804 1912 services.exe 32 PID 1912 wrote to memory of 2804 1912 services.exe 32 PID 1912 wrote to memory of 2804 1912 services.exe 32 PID 1912 wrote to memory of 2804 1912 services.exe 32 PID 1912 wrote to memory of 2584 1912 services.exe 33 PID 1912 wrote to memory of 2584 1912 services.exe 33 PID 1912 wrote to memory of 2584 1912 services.exe 33 PID 1912 wrote to memory of 2584 1912 services.exe 33 PID 2784 wrote to memory of 308 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 36 PID 2784 wrote to memory of 308 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 36 PID 2784 wrote to memory of 308 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 36 PID 2784 wrote to memory of 308 2784 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 36 PID 2804 wrote to memory of 1316 2804 NET.exe 37 PID 2804 wrote to memory of 1316 2804 NET.exe 37 PID 2804 wrote to memory of 1316 2804 NET.exe 37 PID 2804 wrote to memory of 1316 2804 NET.exe 37 PID 2584 wrote to memory of 2544 2584 NET.exe 39 PID 2584 wrote to memory of 2544 2584 NET.exe 39 PID 2584 wrote to memory of 2544 2584 NET.exe 39 PID 2584 wrote to memory of 2544 2584 NET.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\NET.exeNET STOP srservice4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice5⤵
- System Location Discovery: System Language Discovery
PID:1316
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc5⤵
- System Location Discovery: System Language Discovery
PID:2544
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:308
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133B
MD5db500d9bf07e7c0b4fdda096b9311552
SHA125f174a961d6f28206208139c9f07adc1128f8b1
SHA256db36804977b89d9e9669a20159b47bf0d8bdd1d7c229074647e06ec75f054fd5
SHA512c67215fb34cd039984d8a98626a9153a43043776f5ccedd7773bef65cd3210b5298965313dabe85f3ae21be2ca20f1dfe5042ddbc8cf1d0fa3fca518f9b8f6d9
-
Filesize
342KB
MD51a390ce9a38656bacbab2c736b376086
SHA18ed6c5c558ccef8562e9b414efc258933e60ea6f
SHA256c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa
SHA512a42b3754c2e1ebba6c2cbae61825243f93c3d1322c08c924003a53af10c9fbc9c0f9d07854dae9a1cffe2ea99986cdb0250c6c9989abbd65c8c6c7d7eaf44a8a
-
Filesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
Filesize
13KB
MD5b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA25645d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066