Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe
-
Size
1.6MB
-
MD5
215d16efbce14a9385f47b9dbe9ca73e
-
SHA1
038a11a7e784aca5bfa0217cf7dae1ba41ff9120
-
SHA256
f37680001592883b59ed4efab00a3322ce536a210d93ffdb62582ca6075530ee
-
SHA512
3e66476219b689cce56b593aabe989c35ba22be314660965bbced6eafed162f07d3b75e93474a9b5db0055cfa06e6e30c3bbc031ba09cf46c439435c07d10547
-
SSDEEP
24576:GwsXFkwRvJwSEznAm3Fiua8LMgRd0Btyj9R0Cg1hc1vhszDGuDrXZONjZWmQmy5g:Gw6+LSEM6AuazyUw0Cg1hc1ZsWy9ruK
Malware Config
Extracted
latentbot
noiptest1905.zapto.org
Signatures
-
Latentbot family
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rundll.exe = "\"C:\\Users\\Admin\\AppData\\Local\\rundll.exe \"" reg.exe -
Executes dropped EXE 2 IoCs
pid Process 1524 standard.exe 2820 rundll.exe -
Loads dropped DLL 5 IoCs
pid Process 2516 JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe 2516 JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe 1524 standard.exe 1524 standard.exe 2820 rundll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language standard.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2756 reg.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 1524 standard.exe 2820 rundll.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1524 standard.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2820 rundll.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1524 2516 JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe 30 PID 2516 wrote to memory of 1524 2516 JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe 30 PID 2516 wrote to memory of 1524 2516 JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe 30 PID 2516 wrote to memory of 1524 2516 JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe 30 PID 1524 wrote to memory of 2284 1524 standard.exe 31 PID 1524 wrote to memory of 2284 1524 standard.exe 31 PID 1524 wrote to memory of 2284 1524 standard.exe 31 PID 1524 wrote to memory of 2284 1524 standard.exe 31 PID 2284 wrote to memory of 2716 2284 cmd.exe 33 PID 2284 wrote to memory of 2716 2284 cmd.exe 33 PID 2284 wrote to memory of 2716 2284 cmd.exe 33 PID 2284 wrote to memory of 2716 2284 cmd.exe 33 PID 2716 wrote to memory of 2756 2716 cmd.exe 34 PID 2716 wrote to memory of 2756 2716 cmd.exe 34 PID 2716 wrote to memory of 2756 2716 cmd.exe 34 PID 2716 wrote to memory of 2756 2716 cmd.exe 34 PID 1524 wrote to memory of 2820 1524 standard.exe 35 PID 1524 wrote to memory of 2820 1524 standard.exe 35 PID 1524 wrote to memory of 2820 1524 standard.exe 35 PID 1524 wrote to memory of 2820 1524 standard.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_215d16efbce14a9385f47b9dbe9ca73e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Roaming\Microsoft\standard.exeC:\Users\Admin\AppData\Roaming\Microsoft\standard.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd /c syscheck.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /V rundll.exe /D "\"C:\Users\Admin\AppData\Local\rundll.exe \"" /f5⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2756
-
-
-
-
C:\Users\Admin\AppData\Local\rundll.exe"C:\Users\Admin\AppData\Local\rundll.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
170B
MD5d53c75977954601b591dba8be2f53cd1
SHA15073b31394b4bb63af3d7ec0985d3a66d209abbe
SHA256789c15d1350284cf0270658c414fa4ed204473644675cb13f9e3981d89724090
SHA512baa379fc240cc3e26155eaf71fa61fad78ba781f00615055e5227ccaf81bcde74723231d20b157ed2a78bf354b617da5d9d21a0badb11eb1bb3a87a86cf40ca9
-
Filesize
402KB
MD53bcb5781f7563dee4346a4af5f8e6742
SHA173486ae550ba28970eaae921541f8081f082ca42
SHA256c56a77dcb580958ff7e6cfdfc155ffa0f6e289ba4fcba4968bdfed0f71a7ba91
SHA5122f8c41a3dd8c73f23fbb11ecab91de4ff834c218ef0ee4fd5501400892f8c171f3e35cfd78523b5a3a5bc691b66cc7d44bc5a9311287f030b704d449c516c758
-
Filesize
185KB
MD5c9c8e05aae60e89e9a46d606fca73341
SHA1aac659be91a7fe3cfb1c7c525f95987042697cce
SHA256c06ca0589f7ba5048a6f73b3f9c0279de3d8935ce7b9e416abb07612dbe4aada
SHA5123f4a7c2ed0abe8eb4635d3e4566bea16bd2d23ed16ba4f5e85d1afaa6523729a2a178559387a01fa1743b1bd0113933dcd41000a1293994b451252edb4c2e593
-
Filesize
1.2MB
MD5bf57ce4e8e9abf193ac08c79b20d0737
SHA1089cee1c22d2ffaff24e1fe846bba5cfd2e6361d
SHA256bd204587bea4eea0fa3c6fedfb1b4cc5045a0807f6283b759058078292345f94
SHA5127ea3a7e4919adf84ffb52df594bf4cefa1fb09b10aaad241c3eff06ce2cca2588d473be23b51c0b4d0d4fcd5349cefd9e54c3449ebd199304f18ae9c33381b84