Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe
-
Size
44KB
-
MD5
278b149e1ad153373e8f0dd292baa94d
-
SHA1
57ac1a905d37a126313b545878dc9bccd7493522
-
SHA256
e1b3b8aa163cc3113095714cd370dd11e6b9647356d73d49d0bebacff951005c
-
SHA512
b7950d86d19cebaee62f119238cf02b5b6a7af8694174922277e091f5c65b704d63d7efdafe2dfed85aa0755af597961ad2505ecc1b43b3b1d3f67387102bd8a
-
SSDEEP
768:ULq06gCeVaKY7HxxgycnVMh9BwyGK2Bn0nFgJhcthlVCUJeKJkuN+ALAx9b:vFK88/Oh9BwV6nKJhcayx8AU3b
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exeC:\\Users\\Admin\\AppData\\Roaming\\appconf32.exe," TSTheme.exe -
Deletes itself 1 IoCs
pid Process 2688 TSTheme.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 TSTheme.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSTheme.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" TSTheme.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" TSTheme.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main TSTheme.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe 2688 TSTheme.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30 PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30 PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30 PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30 PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30 PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30 PID 2764 wrote to memory of 2688 2764 JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_278b149e1ad153373e8f0dd292baa94d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\TSTheme.exeC:\Windows\system32\TSTheme.exe2⤵
- Modifies WinLogon for persistence
- Deletes itself
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2688
-