Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 23:13
Behavioral task
behavioral1
Sample
1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe
-
Size
342KB
-
MD5
1a390ce9a38656bacbab2c736b376086
-
SHA1
8ed6c5c558ccef8562e9b414efc258933e60ea6f
-
SHA256
c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa
-
SHA512
a42b3754c2e1ebba6c2cbae61825243f93c3d1322c08c924003a53af10c9fbc9c0f9d07854dae9a1cffe2ea99986cdb0250c6c9989abbd65c8c6c7d7eaf44a8a
-
SSDEEP
6144:9Rqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yXoQHtVee:DqmpplpGoGL3etQoMiXM8gxf/Sj4yXlu
Malware Config
Extracted
latentbot
lesperez1337.zapto.org
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x000a0000000233e9-21.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 1628 fservice.exe 4028 services.exe -
Loads dropped DLL 5 IoCs
pid Process 4028 services.exe 4028 services.exe 4028 services.exe 1628 fservice.exe 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe -
resource yara_rule behavioral2/memory/4224-0-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/files/0x0009000000023390-6.dat upx behavioral2/memory/1628-9-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1628-37-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4224-38-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-40-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-42-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-44-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-46-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-48-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-50-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-52-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-54-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-56-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-58-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-60-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-62-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-64-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-66-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4028-68-0x0000000000400000-0x00000000005FC000-memory.dmp upx -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe File opened for modification C:\Windows\system\sservice.exe 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fservice.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe 4028 services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4028 services.exe 4028 services.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4224 wrote to memory of 1628 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 82 PID 4224 wrote to memory of 1628 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 82 PID 4224 wrote to memory of 1628 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 82 PID 1628 wrote to memory of 4028 1628 fservice.exe 83 PID 1628 wrote to memory of 4028 1628 fservice.exe 83 PID 1628 wrote to memory of 4028 1628 fservice.exe 83 PID 4028 wrote to memory of 4744 4028 services.exe 84 PID 4028 wrote to memory of 4744 4028 services.exe 84 PID 4028 wrote to memory of 4744 4028 services.exe 84 PID 4028 wrote to memory of 4564 4028 services.exe 85 PID 4028 wrote to memory of 4564 4028 services.exe 85 PID 4028 wrote to memory of 4564 4028 services.exe 85 PID 4224 wrote to memory of 4396 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 88 PID 4224 wrote to memory of 4396 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 88 PID 4224 wrote to memory of 4396 4224 1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe 88 PID 4564 wrote to memory of 1344 4564 NET.exe 89 PID 4564 wrote to memory of 1344 4564 NET.exe 89 PID 4564 wrote to memory of 1344 4564 NET.exe 89 PID 4744 wrote to memory of 5056 4744 NET.exe 91 PID 4744 wrote to memory of 5056 4744 NET.exe 91 PID 4744 wrote to memory of 5056 4744 NET.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\NET.exeNET STOP srservice4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice5⤵
- System Location Discovery: System Language Discovery
PID:5056
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc5⤵
- System Location Discovery: System Language Discovery
PID:1344
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1a390ce9a38656bacbab2c736b376086_JaffaCakes118.exe.bat2⤵
- System Location Discovery: System Language Discovery
PID:4396
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133B
MD5db500d9bf07e7c0b4fdda096b9311552
SHA125f174a961d6f28206208139c9f07adc1128f8b1
SHA256db36804977b89d9e9669a20159b47bf0d8bdd1d7c229074647e06ec75f054fd5
SHA512c67215fb34cd039984d8a98626a9153a43043776f5ccedd7773bef65cd3210b5298965313dabe85f3ae21be2ca20f1dfe5042ddbc8cf1d0fa3fca518f9b8f6d9
-
Filesize
342KB
MD51a390ce9a38656bacbab2c736b376086
SHA18ed6c5c558ccef8562e9b414efc258933e60ea6f
SHA256c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa
SHA512a42b3754c2e1ebba6c2cbae61825243f93c3d1322c08c924003a53af10c9fbc9c0f9d07854dae9a1cffe2ea99986cdb0250c6c9989abbd65c8c6c7d7eaf44a8a
-
Filesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
Filesize
13KB
MD5b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA25645d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066