Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
e579348f0efa5c965fa570e7da12d056
-
SHA1
70faa1e256d616121141c073b3ec6443f9de469d
-
SHA256
5d4447c12af07349b13f38c6d0dd226915a27a7bba6aa40b7b65ea6a87e3a305
-
SHA512
100e266a4a297ecee254f0398ca9c717ac972b236e3165b1a9736c6da31cb39b2127979610f070766539b14f1701fa4fcc41248f95d71f5f8a4a995d18b84644
-
SSDEEP
98304:mOcd1iEPw3V56K3U9+JYhfF5kt03XzzO6bcSiUyo2GE:mO+QE2V5++JYASDzO6biz5GE
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000015e66-92.dat acprotect behavioral1/files/0x0009000000015c2d-91.dat acprotect -
resource yara_rule behavioral1/files/0x0007000000015c13-55.dat aspack_v212_v242 behavioral1/files/0x0007000000015bfe-93.dat aspack_v212_v242 -
Executes dropped EXE 9 IoCs
pid Process 2512 aimware.sfx.exe 2492 aimware.exe 2736 rutserv.exe 780 rutserv.exe 2428 rutserv.exe 656 rutserv.exe 1516 rfusclient.exe 1324 rfusclient.exe 3040 rfusclient.exe -
Loads dropped DLL 6 IoCs
pid Process 2452 cmd.exe 2512 aimware.sfx.exe 2512 aimware.sfx.exe 2512 aimware.sfx.exe 2432 cmd.exe 656 rutserv.exe -
resource yara_rule behavioral1/files/0x0008000000015e66-92.dat upx behavioral1/files/0x0009000000015c2d-91.dat upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2732 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 2012 taskkill.exe 1704 taskkill.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2708 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2736 rutserv.exe 2736 rutserv.exe 2736 rutserv.exe 2736 rutserv.exe 780 rutserv.exe 780 rutserv.exe 2428 rutserv.exe 2428 rutserv.exe 656 rutserv.exe 656 rutserv.exe 656 rutserv.exe 656 rutserv.exe 1516 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 3040 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 1704 taskkill.exe Token: SeDebugPrivilege 2736 rutserv.exe Token: SeDebugPrivilege 2428 rutserv.exe Token: SeTakeOwnershipPrivilege 656 rutserv.exe Token: SeTcbPrivilege 656 rutserv.exe Token: SeTcbPrivilege 656 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2736 rutserv.exe 780 rutserv.exe 2428 rutserv.exe 656 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 28 PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 28 PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 28 PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe 28 PID 2452 wrote to memory of 2512 2452 cmd.exe 30 PID 2452 wrote to memory of 2512 2452 cmd.exe 30 PID 2452 wrote to memory of 2512 2452 cmd.exe 30 PID 2452 wrote to memory of 2512 2452 cmd.exe 30 PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe 31 PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe 31 PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe 31 PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe 31 PID 2492 wrote to memory of 2568 2492 aimware.exe 32 PID 2492 wrote to memory of 2568 2492 aimware.exe 32 PID 2492 wrote to memory of 2568 2492 aimware.exe 32 PID 2492 wrote to memory of 2568 2492 aimware.exe 32 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2568 wrote to memory of 2432 2568 WScript.exe 33 PID 2432 wrote to memory of 2012 2432 cmd.exe 35 PID 2432 wrote to memory of 2012 2432 cmd.exe 35 PID 2432 wrote to memory of 2012 2432 cmd.exe 35 PID 2432 wrote to memory of 2012 2432 cmd.exe 35 PID 2432 wrote to memory of 1704 2432 cmd.exe 37 PID 2432 wrote to memory of 1704 2432 cmd.exe 37 PID 2432 wrote to memory of 1704 2432 cmd.exe 37 PID 2432 wrote to memory of 1704 2432 cmd.exe 37 PID 2432 wrote to memory of 2692 2432 cmd.exe 38 PID 2432 wrote to memory of 2692 2432 cmd.exe 38 PID 2432 wrote to memory of 2692 2432 cmd.exe 38 PID 2432 wrote to memory of 2692 2432 cmd.exe 38 PID 2432 wrote to memory of 2708 2432 cmd.exe 39 PID 2432 wrote to memory of 2708 2432 cmd.exe 39 PID 2432 wrote to memory of 2708 2432 cmd.exe 39 PID 2432 wrote to memory of 2708 2432 cmd.exe 39 PID 2432 wrote to memory of 2732 2432 cmd.exe 40 PID 2432 wrote to memory of 2732 2432 cmd.exe 40 PID 2432 wrote to memory of 2732 2432 cmd.exe 40 PID 2432 wrote to memory of 2732 2432 cmd.exe 40 PID 2432 wrote to memory of 2736 2432 cmd.exe 41 PID 2432 wrote to memory of 2736 2432 cmd.exe 41 PID 2432 wrote to memory of 2736 2432 cmd.exe 41 PID 2432 wrote to memory of 2736 2432 cmd.exe 41 PID 2432 wrote to memory of 780 2432 cmd.exe 42 PID 2432 wrote to memory of 780 2432 cmd.exe 42 PID 2432 wrote to memory of 780 2432 cmd.exe 42 PID 2432 wrote to memory of 780 2432 cmd.exe 42 PID 2432 wrote to memory of 2428 2432 cmd.exe 43 PID 2432 wrote to memory of 2428 2432 cmd.exe 43 PID 2432 wrote to memory of 2428 2432 cmd.exe 43 PID 2432 wrote to memory of 2428 2432 cmd.exe 43 PID 656 wrote to memory of 1516 656 rutserv.exe 45 PID 656 wrote to memory of 1516 656 rutserv.exe 45 PID 656 wrote to memory of 1516 656 rutserv.exe 45 PID 656 wrote to memory of 1516 656 rutserv.exe 45 PID 656 wrote to memory of 1324 656 rutserv.exe 46 PID 656 wrote to memory of 1324 656 rutserv.exe 46 PID 656 wrote to memory of 1324 656 rutserv.exe 46 PID 656 wrote to memory of 1324 656 rutserv.exe 46 PID 1516 wrote to memory of 3040 1516 rfusclient.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\1.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\programdata\aimware.sfx.exeaimware.sfx.exe -p123 -dc:\programdata3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\programdata\aimware.exe"C:\programdata\aimware.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\programdata\windows\install.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\ProgramData\windows\install.bat" "6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f7⤵PID:2692
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"7⤵
- Runs .reg file with regedit
PID:2708
-
-
C:\Windows\SysWOW64\timeout.exetimeout 27⤵
- Delays execution with timeout.exe
PID:2732
-
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /silentinstall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /firewall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:780
-
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /start7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2428
-
-
-
-
-
-
-
\??\c:\programdata\windows\rutserv.exec:\programdata\windows\rutserv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:3040
-
-
-
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe /tray2⤵
- Executes dropped EXE
PID:1324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38B
MD510b10fec28fbccb28922b7ad20536150
SHA174a2327ebba2f695da13095a70f5161450b915aa
SHA25607420e294de66019f7fbaa4f87da9ee9dc7389cda09af38f7040f3cacda21dfb
SHA512d215c21000a213aa41a1599e269f704e31d96f7c4713962cac6a8bb8ef21f92b70aa257cd98d63496ffb220008b22d36d9ee52a66fa939f7fe59697b8a9c3729
-
Filesize
4.0MB
MD58f5f1e00b524b066e052836fd9504aaa
SHA14dafcee2a6743385ec72240146eeeb884a2d47fe
SHA25679e13b0d4703411069ba6794fdc60eba0edad50e2fe0a1afe25e029a87617a28
SHA5126aa3bd4ab3d05652980da22ce2c88c9452f379dd78173c3827806256e0474f14654b20b72d4b910390a40d84ee9afa676c6ffc98fb23945f7f91475948f67373
-
Filesize
480B
MD599db27d776e103cad354b531ee1f20b9
SHA10b82d146df8528f66d1d14756f211fd3a8b1b91a
SHA256240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3
SHA512bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69
-
Filesize
117B
MD565fc32766a238ff3e95984e325357dbb
SHA13ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
-
Filesize
11KB
MD509ab259233e0f0880f2e2446f93cd88a
SHA103b9c6469c90023569f1884494504e2d3d6bbbc6
SHA2567f6e5d028aed528ad7af7672b53526a88a10846c5cf1e49bac3aeff5849a20cb
SHA512babc9e8d611476452026f60d61ee2a5bc2fc3d6303cfee60e894e7f0a4a8e2bd6195d52674cffb96b38c546296ed2c19eebd7aea98ffd5292f328d0f3e9da090
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
Filesize
4.2MB
MD537726e188c9973ba3a0a4de57f96acc2
SHA10668e13cb10947603afccb75b8389d0571199c05
SHA25644f4edd71d129500693ed4f14d1977527b23cb5b3139b0f4e26ae8dd7c9ff19c
SHA512e24935dc1ab74decc2b18ebba8e4b4cfb0564b2735c9a275c5a679eeb8dbaee9cbfbaa551d734cffd252a61088f25ad217ffa00b7e0cebcbd53605af4d5e22ec