Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/02/2025, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe
-
Size
512KB
-
MD5
8ca614e5a46a93622584fbef435ce048
-
SHA1
363c300cb3ded18ebc148ab1a01a5062a74d9037
-
SHA256
4faf111886633b8a43e9a7eb56ea594164b20f9b24ec60982b25dbb162b3499a
-
SHA512
b27b0e00c4bdeae0b307d70f54d8f05c9743672d67a279d4ccc7e211a7ad803889bd4cd10f1068bc1d292e0e19a912d30ad8f758753d4a42a01470bb018fe416
-
SSDEEP
12288:Wd9MNYrwv9DETz/4RLBbsQob0HbBFMPp3cHi7dxHQvt:WSv9EtJbsWdCi7dxy
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 10 IoCs
resource yara_rule behavioral1/memory/2836-24-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-20-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-43-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-44-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-46-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-47-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-48-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-52-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-54-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades behavioral1/memory/2836-59-0x0000000000400000-0x0000000000459000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" reg.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B} winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B} winlogon.exe -
Executes dropped EXE 1 IoCs
pid Process 2836 winlogon.exe -
Loads dropped DLL 5 IoCs
pid Process 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2304 set thread context of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2708 reg.exe 1316 reg.exe 2700 reg.exe 2648 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2836 winlogon.exe Token: SeCreateTokenPrivilege 2836 winlogon.exe Token: SeAssignPrimaryTokenPrivilege 2836 winlogon.exe Token: SeLockMemoryPrivilege 2836 winlogon.exe Token: SeIncreaseQuotaPrivilege 2836 winlogon.exe Token: SeMachineAccountPrivilege 2836 winlogon.exe Token: SeTcbPrivilege 2836 winlogon.exe Token: SeSecurityPrivilege 2836 winlogon.exe Token: SeTakeOwnershipPrivilege 2836 winlogon.exe Token: SeLoadDriverPrivilege 2836 winlogon.exe Token: SeSystemProfilePrivilege 2836 winlogon.exe Token: SeSystemtimePrivilege 2836 winlogon.exe Token: SeProfSingleProcessPrivilege 2836 winlogon.exe Token: SeIncBasePriorityPrivilege 2836 winlogon.exe Token: SeCreatePagefilePrivilege 2836 winlogon.exe Token: SeCreatePermanentPrivilege 2836 winlogon.exe Token: SeBackupPrivilege 2836 winlogon.exe Token: SeRestorePrivilege 2836 winlogon.exe Token: SeShutdownPrivilege 2836 winlogon.exe Token: SeDebugPrivilege 2836 winlogon.exe Token: SeAuditPrivilege 2836 winlogon.exe Token: SeSystemEnvironmentPrivilege 2836 winlogon.exe Token: SeChangeNotifyPrivilege 2836 winlogon.exe Token: SeRemoteShutdownPrivilege 2836 winlogon.exe Token: SeUndockPrivilege 2836 winlogon.exe Token: SeSyncAgentPrivilege 2836 winlogon.exe Token: SeEnableDelegationPrivilege 2836 winlogon.exe Token: SeManageVolumePrivilege 2836 winlogon.exe Token: SeImpersonatePrivilege 2836 winlogon.exe Token: SeCreateGlobalPrivilege 2836 winlogon.exe Token: 31 2836 winlogon.exe Token: 32 2836 winlogon.exe Token: 33 2836 winlogon.exe Token: 34 2836 winlogon.exe Token: 35 2836 winlogon.exe Token: SeDebugPrivilege 2836 winlogon.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2836 winlogon.exe 2836 winlogon.exe 2836 winlogon.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2304 wrote to memory of 2836 2304 JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe 31 PID 2836 wrote to memory of 2692 2836 winlogon.exe 32 PID 2836 wrote to memory of 2692 2836 winlogon.exe 32 PID 2836 wrote to memory of 2692 2836 winlogon.exe 32 PID 2836 wrote to memory of 2692 2836 winlogon.exe 32 PID 2836 wrote to memory of 2544 2836 winlogon.exe 33 PID 2836 wrote to memory of 2544 2836 winlogon.exe 33 PID 2836 wrote to memory of 2544 2836 winlogon.exe 33 PID 2836 wrote to memory of 2544 2836 winlogon.exe 33 PID 2836 wrote to memory of 2652 2836 winlogon.exe 35 PID 2836 wrote to memory of 2652 2836 winlogon.exe 35 PID 2836 wrote to memory of 2652 2836 winlogon.exe 35 PID 2836 wrote to memory of 2652 2836 winlogon.exe 35 PID 2836 wrote to memory of 2812 2836 winlogon.exe 36 PID 2836 wrote to memory of 2812 2836 winlogon.exe 36 PID 2836 wrote to memory of 2812 2836 winlogon.exe 36 PID 2836 wrote to memory of 2812 2836 winlogon.exe 36 PID 2652 wrote to memory of 1316 2652 cmd.exe 42 PID 2652 wrote to memory of 1316 2652 cmd.exe 42 PID 2652 wrote to memory of 1316 2652 cmd.exe 42 PID 2652 wrote to memory of 1316 2652 cmd.exe 42 PID 2692 wrote to memory of 2708 2692 cmd.exe 40 PID 2692 wrote to memory of 2708 2692 cmd.exe 40 PID 2692 wrote to memory of 2708 2692 cmd.exe 40 PID 2692 wrote to memory of 2708 2692 cmd.exe 40 PID 2812 wrote to memory of 2700 2812 cmd.exe 41 PID 2812 wrote to memory of 2700 2812 cmd.exe 41 PID 2812 wrote to memory of 2700 2812 cmd.exe 41 PID 2812 wrote to memory of 2700 2812 cmd.exe 41 PID 2544 wrote to memory of 2648 2544 cmd.exe 43 PID 2544 wrote to memory of 2648 2544 cmd.exe 43 PID 2544 wrote to memory of 2648 2544 cmd.exe 43 PID 2544 wrote to memory of 2648 2544 cmd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ca614e5a46a93622584fbef435ce048.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2708
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2648
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1316
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2700
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5c195458ced2b3d20337f9817d735f325
SHA1c2783201e46f326fda77ebc5899a7959848a2d97
SHA256024c2ba11fc8edeee6aa729e1c962ffaa1ed4c5997fed0ab868921f3a58fc2b2
SHA5127db6a0b9a03ac099d7861f0cce6907d94f36b88d675b19e61a6646036287fdc8db91568403b76cb4be41558812e42bec822db43af7ff7c3474809e4d4fe4340e
-
Filesize
14KB
MD583c8aea2d2e7afa01b0f25d9abc7f390
SHA14f374926246348c508471b032dd4b0739c72b31e
SHA2569ad553a84e90331aeba318956669bdb6fb4cd0d5d59eff0a77b813a3ccb02122
SHA512ae49f0767adffd5df997da3946f6f6136cca2567d5401ef57b1045b88487082664880b1b8fb4f58178e3b30f7b1cd90a621c1b412fff8e048fd2821734c2b080