Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
f5f047d423671c1285618446c0450542_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5f047d423671c1285618446c0450542_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f5f047d423671c1285618446c0450542_JaffaCakes118.exe
-
Size
72KB
-
MD5
f5f047d423671c1285618446c0450542
-
SHA1
356f6878bd3579240f88edc87b89552c86a9f81f
-
SHA256
19fc15f5fb03d827d352cec67baacf19954b69219d40f8ad5bc4de18064c60b8
-
SHA512
3b3fbde9b5612368416ffeb139e326665854f324565f4147b6145182abf20125d6097609fc9c68aaa4870f298820e2aa1ed62214b19e519c7022d8c2fc37e0a1
-
SSDEEP
1536:/5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAERg+ldHDbLLtvQnXpS0UiCHvrl:/p5wfCQF92HpkeWpS+lNDbLxQG7p
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" regedit.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" regedit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\serivces.exe f5f047d423671c1285618446c0450542_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\serivces.exe f5f047d423671c1285618446c0450542_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5f047d423671c1285618446c0450542_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2740 regedit.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2036 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 31 PID 2392 wrote to memory of 2036 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 31 PID 2392 wrote to memory of 2036 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 31 PID 2392 wrote to memory of 2036 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 31 PID 2036 wrote to memory of 2692 2036 cmd.exe 33 PID 2036 wrote to memory of 2692 2036 cmd.exe 33 PID 2036 wrote to memory of 2692 2036 cmd.exe 33 PID 2036 wrote to memory of 2692 2036 cmd.exe 33 PID 2692 wrote to memory of 2656 2692 net.exe 34 PID 2692 wrote to memory of 2656 2692 net.exe 34 PID 2692 wrote to memory of 2656 2692 net.exe 34 PID 2692 wrote to memory of 2656 2692 net.exe 34 PID 2392 wrote to memory of 2840 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 35 PID 2392 wrote to memory of 2840 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 35 PID 2392 wrote to memory of 2840 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 35 PID 2392 wrote to memory of 2840 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 35 PID 2840 wrote to memory of 2740 2840 cmd.exe 36 PID 2840 wrote to memory of 2740 2840 cmd.exe 36 PID 2840 wrote to memory of 2740 2840 cmd.exe 36 PID 2840 wrote to memory of 2740 2840 cmd.exe 36 PID 2392 wrote to memory of 2664 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 37 PID 2392 wrote to memory of 2664 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 37 PID 2392 wrote to memory of 2664 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 37 PID 2392 wrote to memory of 2664 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 37 PID 2392 wrote to memory of 2600 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 38 PID 2392 wrote to memory of 2600 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 38 PID 2392 wrote to memory of 2600 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 38 PID 2392 wrote to memory of 2600 2392 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 38 PID 2664 wrote to memory of 2620 2664 cmd.exe 41 PID 2664 wrote to memory of 2620 2664 cmd.exe 41 PID 2664 wrote to memory of 2620 2664 cmd.exe 41 PID 2664 wrote to memory of 2620 2664 cmd.exe 41 PID 2600 wrote to memory of 2284 2600 cmd.exe 42 PID 2600 wrote to memory of 2284 2600 cmd.exe 42 PID 2600 wrote to memory of 2284 2600 cmd.exe 42 PID 2600 wrote to memory of 2284 2600 cmd.exe 42 PID 2284 wrote to memory of 2400 2284 net.exe 44 PID 2284 wrote to memory of 2400 2284 net.exe 44 PID 2284 wrote to memory of 2400 2284 net.exe 44 PID 2284 wrote to memory of 2400 2284 net.exe 44 PID 2620 wrote to memory of 2096 2620 net.exe 43 PID 2620 wrote to memory of 2096 2620 net.exe 43 PID 2620 wrote to memory of 2096 2620 net.exe 43 PID 2620 wrote to memory of 2096 2620 net.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:2656
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c c:\a.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\regedit.exeREGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg3⤵
- Modifies firewall policy service
- Modifies security service
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop "Security Center"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"4⤵
- System Location Discovery: System Language Discovery
PID:2096
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\net.exenet start SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:2400
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640B
MD570237e6c7f12f17048117b2e1098aef9
SHA1b9735214963e8e3b791bf7113bebbbbf65c4d36d
SHA2566d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c
SHA512bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee
-
Filesize
1KB
MD5d807ec0161c542b23e37898db356c95b
SHA10aac2ef8e1d77868d932a10007efcbd0b69ecdfc
SHA25656cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37
SHA512538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf