Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 23:22
Behavioral task
behavioral1
Sample
e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe
-
Size
552KB
-
MD5
e6197af7dcf03ccb337e9547fe471008
-
SHA1
aca4682905312acf9196ab5ea2b749e3970043a0
-
SHA256
9dc22d0efad27e9cadc12effd11cfc0e8c4cc8fb4fb5246e1610a61219d083a0
-
SHA512
18fe2e27aec0434818f75082e112b40f75cf9674d5cdf5524fa479ead4dc87cd3f70667e75e25ce4672528b29ce3229b9bc33086067942904dd37501c7540e62
-
SSDEEP
12288:FvLVt4Es8COoMnThg6/ZHTfWJKDBm2ebJhe5+e3jMgD:FUEswoMTzZzfWJK02EJhNmMI
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2404 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2484 qowoa.exe 2668 qowoa.exe -
Loads dropped DLL 2 IoCs
pid Process 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1932-0-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/1932-4-0x0000000003B60000-0x0000000003D68000-memory.dmp upx behavioral1/memory/1932-6-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/files/0x000b000000014a1f-14.dat upx behavioral1/memory/2484-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2484-30-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\{C86033AC-560D-73FA-12C3-AA3B62A0C789} = "C:\\Users\\Admin\\AppData\\Roaming\\Cuatam\\qowoa.exe" qowoa.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1932 set thread context of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 2484 set thread context of 2668 2484 qowoa.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2576 1908 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe 2668 qowoa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 2484 qowoa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1932 wrote to memory of 1908 1932 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 28 PID 1908 wrote to memory of 2484 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 29 PID 1908 wrote to memory of 2484 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 29 PID 1908 wrote to memory of 2484 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 29 PID 1908 wrote to memory of 2484 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 29 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2484 wrote to memory of 2668 2484 qowoa.exe 30 PID 2668 wrote to memory of 1116 2668 qowoa.exe 19 PID 2668 wrote to memory of 1116 2668 qowoa.exe 19 PID 2668 wrote to memory of 1116 2668 qowoa.exe 19 PID 2668 wrote to memory of 1116 2668 qowoa.exe 19 PID 2668 wrote to memory of 1116 2668 qowoa.exe 19 PID 2668 wrote to memory of 1224 2668 qowoa.exe 20 PID 2668 wrote to memory of 1224 2668 qowoa.exe 20 PID 2668 wrote to memory of 1224 2668 qowoa.exe 20 PID 2668 wrote to memory of 1224 2668 qowoa.exe 20 PID 2668 wrote to memory of 1224 2668 qowoa.exe 20 PID 2668 wrote to memory of 1244 2668 qowoa.exe 21 PID 2668 wrote to memory of 1244 2668 qowoa.exe 21 PID 2668 wrote to memory of 1244 2668 qowoa.exe 21 PID 2668 wrote to memory of 1244 2668 qowoa.exe 21 PID 2668 wrote to memory of 1244 2668 qowoa.exe 21 PID 2668 wrote to memory of 1908 2668 qowoa.exe 28 PID 2668 wrote to memory of 1908 2668 qowoa.exe 28 PID 2668 wrote to memory of 1908 2668 qowoa.exe 28 PID 2668 wrote to memory of 1908 2668 qowoa.exe 28 PID 2668 wrote to memory of 1908 2668 qowoa.exe 28 PID 1908 wrote to memory of 2404 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2404 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2404 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 31 PID 1908 wrote to memory of 2404 1908 e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2404 2668 qowoa.exe 31 PID 2668 wrote to memory of 2404 2668 qowoa.exe 31 PID 2668 wrote to memory of 2404 2668 qowoa.exe 31 PID 2668 wrote to memory of 2404 2668 qowoa.exe 31 PID 2668 wrote to memory of 2404 2668 qowoa.exe 31 PID 2668 wrote to memory of 2576 2668 qowoa.exe 32 PID 2668 wrote to memory of 2576 2668 qowoa.exe 32 PID 2668 wrote to memory of 2576 2668 qowoa.exe 32 PID 2668 wrote to memory of 2576 2668 qowoa.exe 32 PID 2668 wrote to memory of 2576 2668 qowoa.exe 32 PID 2668 wrote to memory of 524 2668 qowoa.exe 34 PID 2668 wrote to memory of 524 2668 qowoa.exe 34 PID 2668 wrote to memory of 524 2668 qowoa.exe 34 PID 2668 wrote to memory of 524 2668 qowoa.exe 34 PID 2668 wrote to memory of 524 2668 qowoa.exe 34 PID 2668 wrote to memory of 2460 2668 qowoa.exe 35 PID 2668 wrote to memory of 2460 2668 qowoa.exe 35 PID 2668 wrote to memory of 2460 2668 qowoa.exe 35
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1224
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6197af7dcf03ccb337e9547fe471008_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Roaming\Cuatam\qowoa.exe"C:\Users\Admin\AppData\Roaming\Cuatam\qowoa.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Roaming\Cuatam\qowoa.exe"C:\Users\Admin\AppData\Roaming\Cuatam\qowoa.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf2f81ca9.bat"4⤵
- Deletes itself
PID:2404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 3844⤵
- Program crash
PID:2576
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:524
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271B
MD5f68a68f3329bf1423b78873cd1af6435
SHA1b0a9e64b293f19d1044bb8acbb0c012a8cb7b979
SHA25611cfb9b9176bec5e53a0c10790db58ffaf21aab24789933ef8d71ab00fed036f
SHA512eeb9e88c51bf2c35aae7fe094de283baa9a7e33a8daffea7a1bace044bdb6c722ccccf9b273238151238fb71ca6479b96a5b4c1a17a831a2eac8bebab2610c39
-
Filesize
552KB
MD5d0d5a7c7e634cdc076879c8427523d9e
SHA1d1a3c182141f60f2c1ece7fac0de0553998ce6a2
SHA25681fbf2d55070eb77bc5c9e13c57a72c255c41f0bcd6331af5cff9fdad72ac299
SHA512e72028fd8f1d1383aa6f8a37355b108fea0e9344adefb9f24bd53fb0430b40f07ad56db380869a730df569fffc27b3d5cbe8501403a6180c7b5452716949269f