Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe
-
Size
83KB
-
MD5
2cb638bbe1cd5cdc1bb0a497153e3bc1
-
SHA1
7f432fb42ca0881628ec2296d0944717c3796abb
-
SHA256
7996ae64e993f371c7b2915c170dbb4d236f8fe7c091af615de333107a34ff06
-
SHA512
4a376b9d5500ffb35cce866ce2bbb72143ae610aa6dae9042365b56463f38093a458f531bf7772576effa23c6a10d71c5f2879b32a7ac085ab5fdd76435b577f
-
SSDEEP
1536:Ve8k5HYOGfHQ6BHvzq+5hRpfv+7I+vT+eomQxfl04il/wgWLBRX5+9HuLYRgBZ68:/+vT+eFmzitwNL7X5JssWBbPO1
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Client Server Runtime Process = "C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List csrss.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Host-process Windows (Rundll32.exe) = "c:\\users\\admin\\appdata\\roaming\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Host-process Windows (Rundll32.exe) = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\rundll32.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Service Host Process for Windows = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe -
Deletes itself 1 IoCs
pid Process 2416 csrss.exe -
Executes dropped EXE 2 IoCs
pid Process 2208 csrss.exe 2416 csrss.exe -
Loads dropped DLL 3 IoCs
pid Process 2472 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe 2472 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe 2208 csrss.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host-process Windows (Rundll32.exe) = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\rundll32.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host-process Windows (Rundll32.exe) = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\rundll32.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Service Host Process for Windows = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host Process for Windows = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Process = "C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Process = "C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe" 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host-process Windows (Rundll32.exe) = "c:\\users\\admin\\appdata\\roaming\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host-process Windows (Rundll32.exe) = "c:\\users\\admin\\appdata\\roaming\\csrss.exe" csrss.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2460 set thread context of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2208 set thread context of 2416 2208 csrss.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2472 2460 2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe 31 PID 2472 wrote to memory of 2208 2472 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe 32 PID 2472 wrote to memory of 2208 2472 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe 32 PID 2472 wrote to memory of 2208 2472 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe 32 PID 2472 wrote to memory of 2208 2472 2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe 32 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33 PID 2208 wrote to memory of 2416 2208 csrss.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2cb638bbe1cd5cdc1bb0a497153e3bc1_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\users\admin\appdata\local\temp\2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe"c:\users\admin\appdata\local\temp\2cb638bbe1cd5cdc1bb0a497153e3bc1_jaffacakes118.exe"2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Roaming\csrss.exeC:\Users\Admin\AppData\Roaming\csrss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\users\admin\appdata\roaming\csrss.exe"c:\users\admin\appdata\roaming\csrss.exe"4⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2416
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD52cb638bbe1cd5cdc1bb0a497153e3bc1
SHA17f432fb42ca0881628ec2296d0944717c3796abb
SHA2567996ae64e993f371c7b2915c170dbb4d236f8fe7c091af615de333107a34ff06
SHA5124a376b9d5500ffb35cce866ce2bbb72143ae610aa6dae9042365b56463f38093a458f531bf7772576effa23c6a10d71c5f2879b32a7ac085ab5fdd76435b577f