Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
13/03/2025, 08:22
Behavioral task
behavioral1
Sample
JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Resource
win7-20250207-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
-
Size
420KB
-
MD5
6fbc6ed2d1570ec735bb8a5b6cd124e9
-
SHA1
f0c9f75b01e5676d7e4983ace6a43b230b98682d
-
SHA256
2308aa65f6312fa81e82bc345c1e219517b5596a8b0470f51de9a6a57f7ad16a
-
SHA512
300ea880f4bf247d0d7a6ec4aa6ad3f6847b794bf94c01640fea6d3fff6bd06919d608f10c11de3e45c8d7bd7851dde1e5c20d23c9468238b3bda50dbc5c4035
-
SSDEEP
6144:KfZivnaPAQ6BHng5HaqGg779vT/pQNCbw9q4uo0v5l/3ygr:KRYnpQWga611QEbw9q4uo0v5lvH
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2032 reg.exe 2828 reg.exe 2996 reg.exe 2912 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreateTokenPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeAssignPrimaryTokenPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeLockMemoryPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeIncreaseQuotaPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeMachineAccountPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeTcbPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSecurityPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeTakeOwnershipPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeLoadDriverPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSystemProfilePrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSystemtimePrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeProfSingleProcessPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeIncBasePriorityPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreatePagefilePrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreatePermanentPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeBackupPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeRestorePrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeShutdownPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeDebugPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeAuditPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSystemEnvironmentPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeChangeNotifyPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeRemoteShutdownPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeUndockPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSyncAgentPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeEnableDelegationPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeManageVolumePrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeImpersonatePrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreateGlobalPrivilege 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 31 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 32 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 33 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 34 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 35 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 544 wrote to memory of 3068 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 30 PID 544 wrote to memory of 3068 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 30 PID 544 wrote to memory of 3068 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 30 PID 544 wrote to memory of 3068 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 30 PID 544 wrote to memory of 2076 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 31 PID 544 wrote to memory of 2076 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 31 PID 544 wrote to memory of 2076 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 31 PID 544 wrote to memory of 2076 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 31 PID 544 wrote to memory of 2304 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 33 PID 544 wrote to memory of 2304 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 33 PID 544 wrote to memory of 2304 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 33 PID 544 wrote to memory of 2304 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 33 PID 544 wrote to memory of 1648 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 34 PID 544 wrote to memory of 1648 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 34 PID 544 wrote to memory of 1648 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 34 PID 544 wrote to memory of 1648 544 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 34 PID 3068 wrote to memory of 2996 3068 cmd.exe 38 PID 3068 wrote to memory of 2996 3068 cmd.exe 38 PID 3068 wrote to memory of 2996 3068 cmd.exe 38 PID 3068 wrote to memory of 2996 3068 cmd.exe 38 PID 2076 wrote to memory of 2828 2076 cmd.exe 40 PID 2076 wrote to memory of 2828 2076 cmd.exe 40 PID 2076 wrote to memory of 2828 2076 cmd.exe 40 PID 2076 wrote to memory of 2828 2076 cmd.exe 40 PID 2304 wrote to memory of 2032 2304 cmd.exe 39 PID 2304 wrote to memory of 2032 2304 cmd.exe 39 PID 2304 wrote to memory of 2032 2304 cmd.exe 39 PID 2304 wrote to memory of 2032 2304 cmd.exe 39 PID 1648 wrote to memory of 2912 1648 cmd.exe 41 PID 1648 wrote to memory of 2912 1648 cmd.exe 41 PID 1648 wrote to memory of 2912 1648 cmd.exe 41 PID 1648 wrote to memory of 2912 1648 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2912
-
-