Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/12/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
f5f047d423671c1285618446c0450542_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5f047d423671c1285618446c0450542_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f5f047d423671c1285618446c0450542_JaffaCakes118.exe
-
Size
72KB
-
MD5
f5f047d423671c1285618446c0450542
-
SHA1
356f6878bd3579240f88edc87b89552c86a9f81f
-
SHA256
19fc15f5fb03d827d352cec67baacf19954b69219d40f8ad5bc4de18064c60b8
-
SHA512
3b3fbde9b5612368416ffeb139e326665854f324565f4147b6145182abf20125d6097609fc9c68aaa4870f298820e2aa1ed62214b19e519c7022d8c2fc37e0a1
-
SSDEEP
1536:/5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAERg+ldHDbLLtvQnXpS0UiCHvrl:/p5wfCQF92HpkeWpS+lNDbLxQG7p
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" regedit.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" regedit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\serivces.exe f5f047d423671c1285618446c0450542_JaffaCakes118.exe File created C:\Windows\SysWOW64\serivces.exe f5f047d423671c1285618446c0450542_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5f047d423671c1285618446c0450542_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3936 regedit.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4832 wrote to memory of 2392 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 82 PID 4832 wrote to memory of 2392 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 82 PID 4832 wrote to memory of 2392 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 82 PID 2392 wrote to memory of 3196 2392 cmd.exe 84 PID 2392 wrote to memory of 3196 2392 cmd.exe 84 PID 2392 wrote to memory of 3196 2392 cmd.exe 84 PID 3196 wrote to memory of 2512 3196 net.exe 85 PID 3196 wrote to memory of 2512 3196 net.exe 85 PID 3196 wrote to memory of 2512 3196 net.exe 85 PID 4832 wrote to memory of 4120 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 86 PID 4832 wrote to memory of 4120 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 86 PID 4832 wrote to memory of 4120 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 86 PID 4120 wrote to memory of 3936 4120 cmd.exe 87 PID 4120 wrote to memory of 3936 4120 cmd.exe 87 PID 4120 wrote to memory of 3936 4120 cmd.exe 87 PID 4832 wrote to memory of 4896 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 88 PID 4832 wrote to memory of 4896 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 88 PID 4832 wrote to memory of 4896 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 88 PID 4832 wrote to memory of 1184 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 89 PID 4832 wrote to memory of 1184 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 89 PID 4832 wrote to memory of 1184 4832 f5f047d423671c1285618446c0450542_JaffaCakes118.exe 89 PID 4896 wrote to memory of 396 4896 cmd.exe 92 PID 4896 wrote to memory of 396 4896 cmd.exe 92 PID 4896 wrote to memory of 396 4896 cmd.exe 92 PID 1184 wrote to memory of 2844 1184 cmd.exe 93 PID 1184 wrote to memory of 2844 1184 cmd.exe 93 PID 1184 wrote to memory of 2844 1184 cmd.exe 93 PID 2844 wrote to memory of 1408 2844 net.exe 94 PID 396 wrote to memory of 2072 396 net.exe 95 PID 2844 wrote to memory of 1408 2844 net.exe 94 PID 2844 wrote to memory of 1408 2844 net.exe 94 PID 396 wrote to memory of 2072 396 net.exe 95 PID 396 wrote to memory of 2072 396 net.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:2512
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\a.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\regedit.exeREGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg3⤵
- Modifies firewall policy service
- Modifies security service
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop "Security Center"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"4⤵
- System Location Discovery: System Language Discovery
PID:2072
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\net.exenet start SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:1408
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640B
MD570237e6c7f12f17048117b2e1098aef9
SHA1b9735214963e8e3b791bf7113bebbbbf65c4d36d
SHA2566d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c
SHA512bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee
-
Filesize
1KB
MD5d807ec0161c542b23e37898db356c95b
SHA10aac2ef8e1d77868d932a10007efcbd0b69ecdfc
SHA25656cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37
SHA512538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf