Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2025, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe
-
Size
575KB
-
MD5
99d93ff3c3082ef1d1ccb337b4845d7c
-
SHA1
8669a0db25202ecb97d1f8daef2b3441d6d85237
-
SHA256
e28b8d1f52dd283426fe75ae9e583185ab3d754bba19e51bbb15e18249ad4218
-
SHA512
54ccd3614f54a20cdf887afafe94c72b3398dc6a8faf82da43813a2771c72f336005266d014f7b862492194140ffadbcca3959bb42fe4b55fc280ea698b926c1
-
SSDEEP
12288:0AJFWkmn6+TklGvGeA5qMkDrJPLAMXEscq9ADQdZ/r6tmOVXH:Lg/hklaGT5QXXAq96sZ/uH
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 5 IoCs
resource yara_rule behavioral2/memory/3628-50-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral2/memory/3628-58-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral2/memory/3628-59-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral2/memory/3628-62-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral2/memory/3628-72-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Google\googleupdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\googleupdate.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\googleupdate.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7DE8DCD-F6BD-DBED-DEFA-DDFCC625D8E5} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7DE8DCD-F6BD-DBED-DEFA-DDFCC625D8E5}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\googleupdate.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B7DE8DCD-F6BD-DBED-DEFA-DDFCC625D8E5} svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B7DE8DCD-F6BD-DBED-DEFA-DDFCC625D8E5}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\googleupdate.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe -
Executes dropped EXE 4 IoCs
pid Process 1384 Windows 7 Anytime Upgrade Keygen.exe 4148 svchost.exe 4884 svchost.exe 3628 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\googleupdate.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\googleupdate.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4148 set thread context of 4884 4148 svchost.exe 88 PID 4884 set thread context of 3628 4884 svchost.exe 89 -
resource yara_rule behavioral2/memory/3628-47-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/3628-41-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/3628-50-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/3628-58-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/3628-59-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/3628-62-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/3628-72-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows 7 Anytime Upgrade Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4492 reg.exe 3232 reg.exe 4524 reg.exe 3972 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 3628 svchost.exe Token: SeCreateTokenPrivilege 3628 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3628 svchost.exe Token: SeLockMemoryPrivilege 3628 svchost.exe Token: SeIncreaseQuotaPrivilege 3628 svchost.exe Token: SeMachineAccountPrivilege 3628 svchost.exe Token: SeTcbPrivilege 3628 svchost.exe Token: SeSecurityPrivilege 3628 svchost.exe Token: SeTakeOwnershipPrivilege 3628 svchost.exe Token: SeLoadDriverPrivilege 3628 svchost.exe Token: SeSystemProfilePrivilege 3628 svchost.exe Token: SeSystemtimePrivilege 3628 svchost.exe Token: SeProfSingleProcessPrivilege 3628 svchost.exe Token: SeIncBasePriorityPrivilege 3628 svchost.exe Token: SeCreatePagefilePrivilege 3628 svchost.exe Token: SeCreatePermanentPrivilege 3628 svchost.exe Token: SeBackupPrivilege 3628 svchost.exe Token: SeRestorePrivilege 3628 svchost.exe Token: SeShutdownPrivilege 3628 svchost.exe Token: SeDebugPrivilege 3628 svchost.exe Token: SeAuditPrivilege 3628 svchost.exe Token: SeSystemEnvironmentPrivilege 3628 svchost.exe Token: SeChangeNotifyPrivilege 3628 svchost.exe Token: SeRemoteShutdownPrivilege 3628 svchost.exe Token: SeUndockPrivilege 3628 svchost.exe Token: SeSyncAgentPrivilege 3628 svchost.exe Token: SeEnableDelegationPrivilege 3628 svchost.exe Token: SeManageVolumePrivilege 3628 svchost.exe Token: SeImpersonatePrivilege 3628 svchost.exe Token: SeCreateGlobalPrivilege 3628 svchost.exe Token: 31 3628 svchost.exe Token: 32 3628 svchost.exe Token: 33 3628 svchost.exe Token: 34 3628 svchost.exe Token: 35 3628 svchost.exe Token: SeDebugPrivilege 3628 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1384 Windows 7 Anytime Upgrade Keygen.exe 3628 svchost.exe 3628 svchost.exe 3628 svchost.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 556 wrote to memory of 1384 556 JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe 86 PID 556 wrote to memory of 1384 556 JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe 86 PID 556 wrote to memory of 1384 556 JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe 86 PID 556 wrote to memory of 4148 556 JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe 87 PID 556 wrote to memory of 4148 556 JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe 87 PID 556 wrote to memory of 4148 556 JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe 87 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4148 wrote to memory of 4884 4148 svchost.exe 88 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 4884 wrote to memory of 3628 4884 svchost.exe 89 PID 3628 wrote to memory of 4000 3628 svchost.exe 90 PID 3628 wrote to memory of 4000 3628 svchost.exe 90 PID 3628 wrote to memory of 4000 3628 svchost.exe 90 PID 3628 wrote to memory of 536 3628 svchost.exe 91 PID 3628 wrote to memory of 536 3628 svchost.exe 91 PID 3628 wrote to memory of 536 3628 svchost.exe 91 PID 3628 wrote to memory of 2304 3628 svchost.exe 92 PID 3628 wrote to memory of 2304 3628 svchost.exe 92 PID 3628 wrote to memory of 2304 3628 svchost.exe 92 PID 3628 wrote to memory of 4780 3628 svchost.exe 93 PID 3628 wrote to memory of 4780 3628 svchost.exe 93 PID 3628 wrote to memory of 4780 3628 svchost.exe 93 PID 536 wrote to memory of 4492 536 cmd.exe 98 PID 536 wrote to memory of 4492 536 cmd.exe 98 PID 536 wrote to memory of 4492 536 cmd.exe 98 PID 4780 wrote to memory of 3232 4780 cmd.exe 99 PID 4780 wrote to memory of 3232 4780 cmd.exe 99 PID 4780 wrote to memory of 3232 4780 cmd.exe 99 PID 4000 wrote to memory of 4524 4000 cmd.exe 100 PID 4000 wrote to memory of 4524 4000 cmd.exe 100 PID 4000 wrote to memory of 4524 4000 cmd.exe 100 PID 2304 wrote to memory of 3972 2304 cmd.exe 101 PID 2304 wrote to memory of 3972 2304 cmd.exe 101 PID 2304 wrote to memory of 3972 2304 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_99d93ff3c3082ef1d1ccb337b4845d7c.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\Windows 7 Anytime Upgrade Keygen.exe"C:\Users\Admin\AppData\Local\Temp\Windows 7 Anytime Upgrade Keygen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4524
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Google\googleupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Google\googleupdate.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Google\googleupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Google\googleupdate.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3232
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD58682971643ff77e31f069d043b858179
SHA17296e3529b189b3863c7b1a0c562cdce6b8c0406
SHA25607b15fae2aae41c1a895d67c7c893986ca373e5828b9d1a0af109ac3c6f80821
SHA51229d2adcf5af2cf8aafbbc4598f044a0dc3f8f269bd920f177229d58d0128259ad75d93d99b86f9ce6b7a5859d4bbf52fd2fef508412ab6802b43bb9aea10a3bd
-
Filesize
348KB
MD5e8596f9252e57cfc77082b44e58d81df
SHA1e2d6053b25397d9fd05ece7a3c36cefdd22d35a5
SHA25698ed6ae49fd988320234e49e62e8d73c11e9cc44ed491d8000e457648c3b17b1
SHA512ec5560ce01856e843dc0bb8bf9b80e1dc2d8e6735dd65f03a0d7d8e2e87507f8276622326ff4fafddc93ac269a0cdf2eef7a605fa04950e79d62d4f58c5c9641