Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2025, 08:22
Behavioral task
behavioral1
Sample
JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
-
Size
420KB
-
MD5
6fbc6ed2d1570ec735bb8a5b6cd124e9
-
SHA1
f0c9f75b01e5676d7e4983ace6a43b230b98682d
-
SHA256
2308aa65f6312fa81e82bc345c1e219517b5596a8b0470f51de9a6a57f7ad16a
-
SHA512
300ea880f4bf247d0d7a6ec4aa6ad3f6847b794bf94c01640fea6d3fff6bd06919d608f10c11de3e45c8d7bd7851dde1e5c20d23c9468238b3bda50dbc5c4035
-
SSDEEP
6144:KfZivnaPAQ6BHng5HaqGg779vT/pQNCbw9q4uo0v5l/3ygr:KRYnpQWga611QEbw9q4uo0v5lvH
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4776 reg.exe 4024 reg.exe 224 reg.exe 4544 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreateTokenPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeAssignPrimaryTokenPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeLockMemoryPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeIncreaseQuotaPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeMachineAccountPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeTcbPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSecurityPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeTakeOwnershipPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeLoadDriverPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSystemProfilePrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSystemtimePrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeProfSingleProcessPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeIncBasePriorityPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreatePagefilePrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreatePermanentPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeBackupPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeRestorePrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeShutdownPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeDebugPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeAuditPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSystemEnvironmentPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeChangeNotifyPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeRemoteShutdownPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeUndockPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeSyncAgentPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeEnableDelegationPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeManageVolumePrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeImpersonatePrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: SeCreateGlobalPrivilege 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 31 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 32 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 33 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 34 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe Token: 35 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1524 wrote to memory of 3348 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 85 PID 1524 wrote to memory of 3348 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 85 PID 1524 wrote to memory of 3348 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 85 PID 1524 wrote to memory of 3448 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 86 PID 1524 wrote to memory of 3448 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 86 PID 1524 wrote to memory of 3448 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 86 PID 1524 wrote to memory of 1748 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 87 PID 1524 wrote to memory of 1748 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 87 PID 1524 wrote to memory of 1748 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 87 PID 1524 wrote to memory of 5032 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 88 PID 1524 wrote to memory of 5032 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 88 PID 1524 wrote to memory of 5032 1524 JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe 88 PID 3448 wrote to memory of 4776 3448 cmd.exe 93 PID 3448 wrote to memory of 4776 3448 cmd.exe 93 PID 3448 wrote to memory of 4776 3448 cmd.exe 93 PID 5032 wrote to memory of 4024 5032 cmd.exe 95 PID 5032 wrote to memory of 4024 5032 cmd.exe 95 PID 5032 wrote to memory of 4024 5032 cmd.exe 95 PID 1748 wrote to memory of 224 1748 cmd.exe 96 PID 1748 wrote to memory of 224 1748 cmd.exe 96 PID 1748 wrote to memory of 224 1748 cmd.exe 96 PID 3348 wrote to memory of 4544 3348 cmd.exe 97 PID 3348 wrote to memory of 4544 3348 cmd.exe 97 PID 3348 wrote to memory of 4544 3348 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4544
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4776
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4024
-
-