Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2025, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_60f5f8003dffdf64bd93757b37e47600.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_60f5f8003dffdf64bd93757b37e47600.dll
-
Size
356KB
-
MD5
60f5f8003dffdf64bd93757b37e47600
-
SHA1
ccfa7057c14b781f205717f372103a2edc602710
-
SHA256
37ff4a5812bb468ffeaaa8b862c7dca19d38ec915b2c68a26db610e4662ca720
-
SHA512
88736b3d4ad397db6f1522c15ad02afbb38cac7b91d556c2b7d853de2a7ed98095a1ffa59ada0252f8c83dd37561f32bda2134bd35c13d3983ff304345a9b5bd
-
SSDEEP
6144:0iycIL1wIF44qioluL+sKZWqInwvB/dQe2RuyyTQflOQWeD:gpLicolw+s9xnQFb2Ru3+Qty
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:enabled:@shell32.dll,-1" rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 1668 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x000c000000023b3a-3.dat upx behavioral2/memory/1668-5-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1668-18-0x0000000000400000-0x0000000000462000-memory.dmp upx -
Program crash 2 IoCs
pid pid_target Process procid_target 4164 4856 WerFault.exe 82 2464 1668 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1668 rundll32mgr.exe 1668 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe 1668 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1668 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 4856 440 rundll32.exe 82 PID 440 wrote to memory of 4856 440 rundll32.exe 82 PID 440 wrote to memory of 4856 440 rundll32.exe 82 PID 4856 wrote to memory of 1668 4856 rundll32.exe 83 PID 4856 wrote to memory of 1668 4856 rundll32.exe 83 PID 4856 wrote to memory of 1668 4856 rundll32.exe 83 PID 1668 wrote to memory of 616 1668 rundll32mgr.exe 5 PID 1668 wrote to memory of 616 1668 rundll32mgr.exe 5 PID 1668 wrote to memory of 616 1668 rundll32mgr.exe 5 PID 1668 wrote to memory of 616 1668 rundll32mgr.exe 5 PID 1668 wrote to memory of 616 1668 rundll32mgr.exe 5 PID 1668 wrote to memory of 616 1668 rundll32mgr.exe 5 PID 1668 wrote to memory of 672 1668 rundll32mgr.exe 7 PID 1668 wrote to memory of 672 1668 rundll32mgr.exe 7 PID 1668 wrote to memory of 672 1668 rundll32mgr.exe 7 PID 1668 wrote to memory of 672 1668 rundll32mgr.exe 7 PID 1668 wrote to memory of 672 1668 rundll32mgr.exe 7 PID 1668 wrote to memory of 672 1668 rundll32mgr.exe 7 PID 1668 wrote to memory of 772 1668 rundll32mgr.exe 8 PID 1668 wrote to memory of 772 1668 rundll32mgr.exe 8 PID 1668 wrote to memory of 772 1668 rundll32mgr.exe 8 PID 1668 wrote to memory of 772 1668 rundll32mgr.exe 8 PID 1668 wrote to memory of 772 1668 rundll32mgr.exe 8 PID 1668 wrote to memory of 772 1668 rundll32mgr.exe 8 PID 1668 wrote to memory of 776 1668 rundll32mgr.exe 9 PID 1668 wrote to memory of 776 1668 rundll32mgr.exe 9 PID 1668 wrote to memory of 776 1668 rundll32mgr.exe 9 PID 1668 wrote to memory of 776 1668 rundll32mgr.exe 9 PID 1668 wrote to memory of 776 1668 rundll32mgr.exe 9 PID 1668 wrote to memory of 776 1668 rundll32mgr.exe 9 PID 1668 wrote to memory of 800 1668 rundll32mgr.exe 10 PID 1668 wrote to memory of 800 1668 rundll32mgr.exe 10 PID 1668 wrote to memory of 800 1668 rundll32mgr.exe 10 PID 1668 wrote to memory of 800 1668 rundll32mgr.exe 10 PID 1668 wrote to memory of 800 1668 rundll32mgr.exe 10 PID 1668 wrote to memory of 800 1668 rundll32mgr.exe 10 PID 1668 wrote to memory of 916 1668 rundll32mgr.exe 11 PID 1668 wrote to memory of 916 1668 rundll32mgr.exe 11 PID 1668 wrote to memory of 916 1668 rundll32mgr.exe 11 PID 1668 wrote to memory of 916 1668 rundll32mgr.exe 11 PID 1668 wrote to memory of 916 1668 rundll32mgr.exe 11 PID 1668 wrote to memory of 916 1668 rundll32mgr.exe 11 PID 1668 wrote to memory of 972 1668 rundll32mgr.exe 12 PID 1668 wrote to memory of 972 1668 rundll32mgr.exe 12 PID 1668 wrote to memory of 972 1668 rundll32mgr.exe 12 PID 1668 wrote to memory of 972 1668 rundll32mgr.exe 12 PID 1668 wrote to memory of 972 1668 rundll32mgr.exe 12 PID 1668 wrote to memory of 972 1668 rundll32mgr.exe 12 PID 1668 wrote to memory of 380 1668 rundll32mgr.exe 13 PID 1668 wrote to memory of 380 1668 rundll32mgr.exe 13 PID 1668 wrote to memory of 380 1668 rundll32mgr.exe 13 PID 1668 wrote to memory of 380 1668 rundll32mgr.exe 13 PID 1668 wrote to memory of 380 1668 rundll32mgr.exe 13 PID 1668 wrote to memory of 380 1668 rundll32mgr.exe 13 PID 1668 wrote to memory of 408 1668 rundll32mgr.exe 14 PID 1668 wrote to memory of 408 1668 rundll32mgr.exe 14 PID 1668 wrote to memory of 408 1668 rundll32mgr.exe 14 PID 1668 wrote to memory of 408 1668 rundll32mgr.exe 14 PID 1668 wrote to memory of 408 1668 rundll32mgr.exe 14 PID 1668 wrote to memory of 408 1668 rundll32mgr.exe 14 PID 1668 wrote to memory of 656 1668 rundll32mgr.exe 15 PID 1668 wrote to memory of 656 1668 rundll32mgr.exe 15 PID 1668 wrote to memory of 656 1668 rundll32mgr.exe 15 PID 1668 wrote to memory of 656 1668 rundll32mgr.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:772
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:380
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:800
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2936
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3748
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3844
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3908
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4000
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3780
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2336
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4888
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:3300
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4264
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:60
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1108
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2944
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:2684
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1296
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2612
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1360
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1568
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1912
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1924
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1984
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2084
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2160
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2468
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2568
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3312
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60f5f8003dffdf64bd93757b37e47600.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60f5f8003dffdf64bd93757b37e47600.dll,#13⤵
- Modifies firewall policy service
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 3045⤵
- Program crash
PID:2464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 6084⤵
- Program crash
PID:4164
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4492
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:5112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:2168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3668
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1136
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 48562⤵PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1668 -ip 16682⤵PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD5e50b666782d2d3b6ea005a9cab696251
SHA1e5d03862f81ef30a33fa176d22f120ac6a5c48f9
SHA25656a2a37fb6820ab4cc67ac8dda64271468df43e45e64c753e2d3f0dad7463ccd
SHA512814140bea3d5de5665a483aa3869d0298c827aa47be7afc57c5b772e51bb0175db3f629234f8d76f14a32fb5c471252b6aef902c2ef09c1291d8d4d3e878fd94