Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0476649343fa393b6229a069742cce62.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0476649343fa393b6229a069742cce62.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0476649343fa393b6229a069742cce62.exe
-
Size
133KB
-
MD5
0476649343fa393b6229a069742cce62
-
SHA1
1ef55eba1030fd41109d2f3bdc550b2434d7ad46
-
SHA256
e4ce036da7c659bbca369d433038b17cc09d1cad0efd09c65c8cf6c27c844f2a
-
SHA512
fb0c26b8b19b1e978a1f55668c4562c91b777f58f146f89532989da75b1e4bf6969fa7554c08a07bac38092647334c6136654f6ea878cf1ae5ef53e1359c8ccb
-
SSDEEP
3072:pwWTgyslEG/cXo/QZte67g9Nch9kxfkAEnwIFdxlLAbX9JH7s:eWcy20XxZte6och9kZfETFrlLAbtJH7s
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpkh32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpkh32.exe = "C:\\Windows\\SysWOW64\\wmpkh32.exe:*:Enabled:WinMedia Server" wmpkh32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpkh32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpkh32.exe = "C:\\Windows\\SysWOW64\\wmpkh32.exe:*:Enabled:WinMedia Server" wmpkh32.exe -
Deletes itself 1 IoCs
pid Process 2936 wmpkh32.exe -
Executes dropped EXE 2 IoCs
pid Process 2948 wmpkh32.exe 2936 wmpkh32.exe -
Loads dropped DLL 3 IoCs
pid Process 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 2948 wmpkh32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinMedia Server = "C:\\Windows\\SysWOW64\\wmpkh32.exe" wmpkh32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_0476649343fa393b6229a069742cce62.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 JaffaCakes118_0476649343fa393b6229a069742cce62.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpkh32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_0476649343fa393b6229a069742cce62.exe File opened for modification C:\Windows\SysWOW64\wmpkh32.exe JaffaCakes118_0476649343fa393b6229a069742cce62.exe File created C:\Windows\SysWOW64\wmpkh32.exe JaffaCakes118_0476649343fa393b6229a069742cce62.exe File opened for modification C:\Windows\SysWOW64\ wmpkh32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2652 set thread context of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2948 set thread context of 2936 2948 wmpkh32.exe 32 -
resource yara_rule behavioral1/memory/1648-6-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-9-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-11-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-8-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-4-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-2-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-10-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1648-36-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-37-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-38-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-42-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/2936-43-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0476649343fa393b6229a069742cce62.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0476649343fa393b6229a069742cce62.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpkh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpkh32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 2936 wmpkh32.exe 2936 wmpkh32.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 2652 wrote to memory of 1648 2652 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 30 PID 1648 wrote to memory of 2948 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 31 PID 1648 wrote to memory of 2948 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 31 PID 1648 wrote to memory of 2948 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 31 PID 1648 wrote to memory of 2948 1648 JaffaCakes118_0476649343fa393b6229a069742cce62.exe 31 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2948 wrote to memory of 2936 2948 wmpkh32.exe 32 PID 2936 wrote to memory of 1204 2936 wmpkh32.exe 21 PID 2936 wrote to memory of 1204 2936 wmpkh32.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0476649343fa393b6229a069742cce62.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0476649343fa393b6229a069742cce62.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0476649343fa393b6229a069742cce62.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0476649343fa393b6229a069742cce62.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\wmpkh32.exe"C:\Windows\SysWOW64\wmpkh32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\wmpkh32.exe"C:\Windows\SysWOW64\wmpkh32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD50476649343fa393b6229a069742cce62
SHA11ef55eba1030fd41109d2f3bdc550b2434d7ad46
SHA256e4ce036da7c659bbca369d433038b17cc09d1cad0efd09c65c8cf6c27c844f2a
SHA512fb0c26b8b19b1e978a1f55668c4562c91b777f58f146f89532989da75b1e4bf6969fa7554c08a07bac38092647334c6136654f6ea878cf1ae5ef53e1359c8ccb