Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe
-
Size
86KB
-
MD5
e6195ab2ae4670896da889cea7b34fbf
-
SHA1
f162a0862e6ed649a7966a13b4b1bc876ebe8df0
-
SHA256
1b15cc8ec2b087165e7b6f274c520b5a7cb4a065e69d025b49598e4274628afb
-
SHA512
3bd9778ddf267a26e3fc1275ffcd912dd099e3ff5d718c3e4676bcdd766431d6b0d2a6d4a219ca5951e556f82ba4d9389b5bb99fcf63ac9a7f6e7a4927b09a06
-
SSDEEP
1536:uqNKT7yMPPoIhz89F4zoMqUPDg02uvf1VnJGPzPtktWBaRDasm8Y:xIVPokzwkuUbfFffMPyW5IY
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2552 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\1245331720 = "C:\\Users\\Admin\\1245331720.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe Token: SeShutdownPrivilege 2736 shutdown.exe Token: SeRemoteShutdownPrivilege 2736 shutdown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2100 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 28 PID 2292 wrote to memory of 2100 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 28 PID 2292 wrote to memory of 2100 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 28 PID 2292 wrote to memory of 2100 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 28 PID 2100 wrote to memory of 2540 2100 cmd.exe 30 PID 2100 wrote to memory of 2540 2100 cmd.exe 30 PID 2100 wrote to memory of 2540 2100 cmd.exe 30 PID 2100 wrote to memory of 2540 2100 cmd.exe 30 PID 2292 wrote to memory of 2736 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 31 PID 2292 wrote to memory of 2736 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 31 PID 2292 wrote to memory of 2736 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 31 PID 2292 wrote to memory of 2736 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 31 PID 2292 wrote to memory of 2552 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 33 PID 2292 wrote to memory of 2552 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 33 PID 2292 wrote to memory of 2552 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 33 PID 2292 wrote to memory of 2552 2292 e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6195ab2ae4670896da889cea7b34fbf_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1245331720 /t REG_SZ /d "%userprofile%\1245331720.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1245331720 /t REG_SZ /d "C:\Users\Admin\1245331720.exe" /f3⤵
- Adds Run key to start application
PID:2540
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E6195A~1.EXE > nul2⤵
- Deletes itself
PID:2552
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2732
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1892