Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_81b7e24b277f60f44f5098cca27fb004.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_81b7e24b277f60f44f5098cca27fb004.dll
-
Size
120KB
-
MD5
81b7e24b277f60f44f5098cca27fb004
-
SHA1
2f98fc8ba330183a5f2e3c700141168f63959693
-
SHA256
783d5fec332f73daaf8616c3b1e947acd83302c71790aa7a6162ca68c131e7c2
-
SHA512
4fb6e15ed8d8e6c63e145b92d94363373664416a8c94369ebc0a9375478830867bd80c58c26cd38a08dbb3c0b00b8e3cfac28f45f88858264480a008cdbe70e7
-
SSDEEP
1536:JS6RmzC34BdKPOBtegHZoTItDO8PV/ZSkAOIym1fzyvZYU773io7vkFo3r:JPAzC34L7oktKNkRiLyvZYU773iakO
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d76b.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76fa08.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76fa08.exe -
Executes dropped EXE 3 IoCs
pid Process 2052 f76d76b.exe 2576 f76d901.exe 3016 f76fa08.exe -
Loads dropped DLL 6 IoCs
pid Process 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe 2336 rundll32.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76fa08.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76fa08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d76b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76fa08.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76fa08.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f76d76b.exe File opened (read-only) \??\J: f76d76b.exe File opened (read-only) \??\G: f76fa08.exe File opened (read-only) \??\H: f76d76b.exe File opened (read-only) \??\L: f76d76b.exe File opened (read-only) \??\M: f76d76b.exe File opened (read-only) \??\Q: f76d76b.exe File opened (read-only) \??\H: f76fa08.exe File opened (read-only) \??\I: f76fa08.exe File opened (read-only) \??\E: f76d76b.exe File opened (read-only) \??\G: f76d76b.exe File opened (read-only) \??\K: f76d76b.exe File opened (read-only) \??\N: f76d76b.exe File opened (read-only) \??\O: f76d76b.exe File opened (read-only) \??\P: f76d76b.exe File opened (read-only) \??\E: f76fa08.exe -
resource yara_rule behavioral1/memory/2052-64-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-65-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-21-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-22-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-14-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-20-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-19-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-17-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-16-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-15-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-18-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-12-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-66-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-67-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-68-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-70-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-87-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-109-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-111-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2052-157-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/3016-175-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/3016-218-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76d7c9 f76d76b.exe File opened for modification C:\Windows\SYSTEM.INI f76d76b.exe File created C:\Windows\f77281a f76fa08.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d76b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76fa08.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2052 f76d76b.exe 2052 f76d76b.exe 3016 f76fa08.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 2052 f76d76b.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe Token: SeDebugPrivilege 3016 f76fa08.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2068 wrote to memory of 2336 2068 rundll32.exe 31 PID 2336 wrote to memory of 2052 2336 rundll32.exe 32 PID 2336 wrote to memory of 2052 2336 rundll32.exe 32 PID 2336 wrote to memory of 2052 2336 rundll32.exe 32 PID 2336 wrote to memory of 2052 2336 rundll32.exe 32 PID 2052 wrote to memory of 1052 2052 f76d76b.exe 17 PID 2052 wrote to memory of 1072 2052 f76d76b.exe 18 PID 2052 wrote to memory of 1148 2052 f76d76b.exe 20 PID 2052 wrote to memory of 1956 2052 f76d76b.exe 23 PID 2052 wrote to memory of 2068 2052 f76d76b.exe 30 PID 2052 wrote to memory of 2336 2052 f76d76b.exe 31 PID 2052 wrote to memory of 2336 2052 f76d76b.exe 31 PID 2336 wrote to memory of 2576 2336 rundll32.exe 33 PID 2336 wrote to memory of 2576 2336 rundll32.exe 33 PID 2336 wrote to memory of 2576 2336 rundll32.exe 33 PID 2336 wrote to memory of 2576 2336 rundll32.exe 33 PID 2336 wrote to memory of 3016 2336 rundll32.exe 34 PID 2336 wrote to memory of 3016 2336 rundll32.exe 34 PID 2336 wrote to memory of 3016 2336 rundll32.exe 34 PID 2336 wrote to memory of 3016 2336 rundll32.exe 34 PID 2052 wrote to memory of 1052 2052 f76d76b.exe 17 PID 2052 wrote to memory of 1072 2052 f76d76b.exe 18 PID 2052 wrote to memory of 1148 2052 f76d76b.exe 20 PID 2052 wrote to memory of 1956 2052 f76d76b.exe 23 PID 2052 wrote to memory of 2576 2052 f76d76b.exe 33 PID 2052 wrote to memory of 2576 2052 f76d76b.exe 33 PID 2052 wrote to memory of 3016 2052 f76d76b.exe 34 PID 2052 wrote to memory of 3016 2052 f76d76b.exe 34 PID 3016 wrote to memory of 1052 3016 f76fa08.exe 17 PID 3016 wrote to memory of 1072 3016 f76fa08.exe 18 PID 3016 wrote to memory of 1148 3016 f76fa08.exe 20 PID 3016 wrote to memory of 1956 3016 f76fa08.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76fa08.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1052
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1148
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81b7e24b277f60f44f5098cca27fb004.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81b7e24b277f60f44f5098cca27fb004.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\f76d76b.exeC:\Users\Admin\AppData\Local\Temp\f76d76b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\f76d901.exeC:\Users\Admin\AppData\Local\Temp\f76d901.exe4⤵
- Executes dropped EXE
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\f76fa08.exeC:\Users\Admin\AppData\Local\Temp\f76fa08.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3016
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1956
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD572c61afef7530076c380c0f813f3b902
SHA169153e4df572c09c638cad46b3737cd814ac074f
SHA256aa972e899447d140135c8ced7066a3cc04b816cf33bd4cfb34051b8134e026b4
SHA5120e5dbea9d4fe666fd3da8e5b4a5243d946a688a2167fbed6c8ac35d8119953bb07b05fc31a3a7db11d066e6604244243ca6680aeb441985341bb66be44cf91db
-
Filesize
257B
MD56fbed474ef0d6ac92e8e059aa546dd1d
SHA18a317d301c53174c57d7d0d08a3e4c98738f0a40
SHA2569c46ea631ac5143752d171268f9f6a6e54dcdd3e72009c2c2df3bec1dfca34fc
SHA5128b1ad63777f7d6d94ebbf3e7d52a38f275e97df70821a88de7eda5a89f49232ea9e67192398c6900116a09cf1aba1096d1c3044fb1caa2f8c59e9249fec41abc