Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03/02/2025, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe
-
Size
256KB
-
MD5
85c92d8ac2e11e2769f0d22667afe63f
-
SHA1
3ad47c3569d4d815d2f73111d7a67b6d1a14d1d8
-
SHA256
47f6ad8625735cfc195412ae5a878e02e8db6b06ea0a31dc12f1bd105feb0e81
-
SHA512
40564af5912a0fa955ea650a37ee8ac0b99e36766011a34b6ebd2ee45761274bfacf8d6a681395024e55963ae4d6db88d14feb3919fc86ca793ed41ae7e916fc
-
SSDEEP
6144:BzhZLUjD56i5v66oPku3gyBd8Hl3FmcjnU5DOfjZFmi:BzhJUjD56a0g4Y3FmynU5DOrZFmi
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Loads dropped DLL 3 IoCs
pid Process 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
resource yara_rule behavioral1/memory/2248-1-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-3-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-4-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-7-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-5-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-6-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-23-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-30-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-24-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx behavioral1/memory/2248-60-0x0000000001EC0000-0x0000000002F4E000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe Token: SeDebugPrivilege 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1252 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe 19 PID 2248 wrote to memory of 1348 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe 20 PID 2248 wrote to memory of 1412 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe 21 PID 2248 wrote to memory of 1264 2248 JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1252
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85c92d8ac2e11e2769f0d22667afe63f.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1264
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD53fe283870f28c905b8899e553b0f3e1b
SHA1c441db50674c33fad3fa371470a5d9da6c78a01b
SHA256deda4f61055f1ac7e014f9eb21c873b3a961ad3314f9f6dc1cce2ed9bd4654e7
SHA512ac2739c14d769dc41f24027a80d920c48a964f58cf37720e4f958cb89122f29ffaf1a26a5b4298eb8ccdcaab50f34665fc709e470e6649a97a371f08ae4a060f
-
Filesize
11KB
MD5959ea64598b9a3e494c00e8fa793be7e
SHA140f284a3b92c2f04b1038def79579d4b3d066ee0
SHA25603cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
SHA5125e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
-
Filesize
6KB
MD508e9796ca20c5fc5076e3ac05fb5709a
SHA107971d52dcbaa1054060073571ced046347177f7
SHA2568165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
SHA51202618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4