Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 07:50
Behavioral task
behavioral1
Sample
1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe
-
Size
3.6MB
-
MD5
1caae598f7385ec3a7480a7dfb9e059a
-
SHA1
236545e3b19703c942caee2d380b8f475b34b29f
-
SHA256
15dbec53eec39a12947a6e575d5b722aeff28a0d5ae5529c20d5995f8a02c8d2
-
SHA512
62392b4ad9b7b6cb77d11e60d8f7d0c80653aec4c469f557ac207e0b1f7df55432b779b87fe5ae8350d03c54daf238fafa80bf12f6f29c2561433a594bbf2209
-
SSDEEP
98304:ABQPJ7Id7A6gp7b0wWxCqmLDux+9y+g5Ld43zM7xLGhGJ:ABQPJ7+7ATp7b1WxrmXu+yI3zM7RGIJ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ IntelRapid.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2560 IntelRapid.exe -
Loads dropped DLL 3 IoCs
pid Process 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1756-0-0x000000013FA60000-0x00000001403EF000-memory.dmp themida behavioral1/memory/1756-2-0x000000013FA60000-0x00000001403EF000-memory.dmp themida behavioral1/memory/1756-3-0x000000013FA60000-0x00000001403EF000-memory.dmp themida behavioral1/memory/1756-4-0x000000013FA60000-0x00000001403EF000-memory.dmp themida behavioral1/memory/1756-5-0x000000013FA60000-0x00000001403EF000-memory.dmp themida behavioral1/files/0x000b000000014323-8.dat themida behavioral1/memory/1756-18-0x000000013FA60000-0x00000001403EF000-memory.dmp themida behavioral1/memory/2560-21-0x000000013F6F0000-0x000000014007F000-memory.dmp themida behavioral1/memory/2560-24-0x000000013F6F0000-0x000000014007F000-memory.dmp themida behavioral1/memory/2560-26-0x000000013F6F0000-0x000000014007F000-memory.dmp themida behavioral1/memory/2560-27-0x000000013F6F0000-0x000000014007F000-memory.dmp themida behavioral1/memory/2560-28-0x000000013F6F0000-0x000000014007F000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe 2560 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2560 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2560 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe 28 PID 1756 wrote to memory of 2560 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe 28 PID 1756 wrote to memory of 2560 1756 1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe 28 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD51caae598f7385ec3a7480a7dfb9e059a
SHA1236545e3b19703c942caee2d380b8f475b34b29f
SHA25615dbec53eec39a12947a6e575d5b722aeff28a0d5ae5529c20d5995f8a02c8d2
SHA51262392b4ad9b7b6cb77d11e60d8f7d0c80653aec4c469f557ac207e0b1f7df55432b779b87fe5ae8350d03c54daf238fafa80bf12f6f29c2561433a594bbf2209