Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe
-
Size
43KB
-
MD5
e398d11d48cb29ad19b6f8c397d17075
-
SHA1
fc9c24d10314584c19189d2ee2861291f6124b73
-
SHA256
436ebc3aa03e072cc805fb19853ae6c43be065b416378c7d1e85281bfaff2204
-
SHA512
3d5c61155cf120cd0a5fdb8e4c18c44513f5bf46b8f6b1619821be6f98fcb37ab1fb4d9ec24ad42f3e9e6403c412bedc5b884d8b84ddc42a93c31a1c4ac60e73
-
SSDEEP
768:sbUnHumDRFMzEDNbRjLOyDo03FpUL3QdX:sbUnHLFMzEDNl1pMgZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2564 fxstaller.exe 2528 fxstaller.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center = "fxstaller.exe" e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2872 set thread context of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2564 set thread context of 2528 2564 fxstaller.exe 30 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\fxstaller.exe e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe File opened for modification C:\Windows\fxstaller.exe e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 2564 fxstaller.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2504 2872 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 28 PID 2504 wrote to memory of 2564 2504 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 29 PID 2504 wrote to memory of 2564 2504 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 29 PID 2504 wrote to memory of 2564 2504 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 29 PID 2504 wrote to memory of 2564 2504 e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe 29 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30 PID 2564 wrote to memory of 2528 2564 fxstaller.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e398d11d48cb29ad19b6f8c397d17075_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\fxstaller.exe"C:\Windows\fxstaller.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\fxstaller.exe"C:\Windows\fxstaller.exe"4⤵
- Executes dropped EXE
PID:2528
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5e398d11d48cb29ad19b6f8c397d17075
SHA1fc9c24d10314584c19189d2ee2861291f6124b73
SHA256436ebc3aa03e072cc805fb19853ae6c43be065b416378c7d1e85281bfaff2204
SHA5123d5c61155cf120cd0a5fdb8e4c18c44513f5bf46b8f6b1619821be6f98fcb37ab1fb4d9ec24ad42f3e9e6403c412bedc5b884d8b84ddc42a93c31a1c4ac60e73