Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe
-
Size
18KB
-
MD5
450863e09f5c55435b53deb296e9c4b9
-
SHA1
2bdb82e592ec9f931ddb103958d84564525002c1
-
SHA256
e305830cf24d3f63d62c18834601d6f3cbd0171a860e93d386b5e9eff5cc3821
-
SHA512
6995cc698a84b77e12ebd22acd9f1e0473bff507628e6eaac177cdc01d81e1ab3e11c058970c83f365972dcc92411d27822565f0eb0682896cdbdf42eb278d8e
-
SSDEEP
384:lHy161IxKjXudLBkhQNJ/Uo5TPrZ4j6YLPuu2EN4SpNucdS4eUtRQa1q0bLsu:e+0K4B0QNJBTDiGYL7BLucdkZaz4u
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\mfdesy.dll 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe File created C:\Windows\SysWOW64\tf0 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mfdesy.dll.LoG 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC3D30AE-0380-4151-8934-EE98A34B0370} 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC3D30AE-0380-4151-8934-EE98A34B0370}\InProcServer32 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC3D30AE-0380-4151-8934-EE98A34B0370}\InProcServer32\ThreadingModel = "Apartment" 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\software\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC3D30AE-0380-4151-8934-EE98A34B0370}\ = "Microsoft" 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC3D30AE-0380-4151-8934-EE98A34B0370}\InProcServer32\ = "C:\\Windows\\SysWow64\\mfdesy.dll" 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\software 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\microsoft 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Token: SeRestorePrivilege 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Token: SeBackupPrivilege 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe Token: SeRestorePrivilege 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2380 450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\450863e09f5c55435b53deb296e9c4b9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
217KB
MD5e432b685b17e7f014358e6953ff03fc6
SHA1d791ac4df3ad4630ccdcb4442a9b04279f3a6742
SHA256889976326e9b3c7003c1691df800467c5114be052ea1b4e5c1c39434a87dcffd
SHA5120b83dee8ce4ef3a03e1cc8b97ffd725ba66fde32d6bf50e445e363c81589c36ed3c37f58458a0736cb18477bcb09d50327f1a95d36491d45b2087b9b7114617b