Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
e7a9ea533f97172e64ae9d8509d7eaa2
-
SHA1
db2258cac6ae063c3349e8c14acd929a2a5f4f43
-
SHA256
762f8497e5c2b9ce01f00b27f581fcf520dc5a2c481dad7948801fe6ce4fb953
-
SHA512
df3e04c84bef9616ad5530ab9cd413e197415192a25f8a1c63588c09d4b4b8d4d18e88c1b50d028f859ec4c978e49b614f242b455908da53e8dd559d6c045294
-
SSDEEP
49152:O/aoYUrbV6cdRJodwU0FeV6mIQ45UC7DqWiAvFrVw2feB8HW1mc:Ea9IRzdnReV69Q4mMDqtAFVdDWf
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2736 rinst.exe 2104 SandboxieInstall.exe 2532 SandboxieInstall-64-bit-259425232.exe -
Loads dropped DLL 8 IoCs
pid Process 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 2736 rinst.exe 2104 SandboxieInstall.exe 2532 SandboxieInstall-64-bit-259425232.exe 2532 SandboxieInstall-64-bit-259425232.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\svchostwb.dll rinst.exe File created C:\Windows\SysWOW64\inst.dat rinst.exe File created C:\Windows\SysWOW64\rinst.exe rinst.exe File created C:\Windows\SysWOW64\pk.bin rinst.exe File created C:\Windows\SysWOW64\svchost.exe rinst.exe File created C:\Windows\SysWOW64\svchosthk.dll rinst.exe File created C:\Windows\SysWOW64\kw.dat rinst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x0006000000016d4a-51.dat nsis_installer_1 behavioral1/files/0x0006000000016d4a-51.dat nsis_installer_2 behavioral1/files/0x0007000000016cf0-33.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2532 SandboxieInstall-64-bit-259425232.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2736 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 28 PID 3048 wrote to memory of 2736 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 28 PID 3048 wrote to memory of 2736 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 28 PID 3048 wrote to memory of 2736 3048 e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 2104 2736 rinst.exe 29 PID 2736 wrote to memory of 1976 2736 rinst.exe 30 PID 2736 wrote to memory of 1976 2736 rinst.exe 30 PID 2736 wrote to memory of 1976 2736 rinst.exe 30 PID 2736 wrote to memory of 1976 2736 rinst.exe 30 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31 PID 2104 wrote to memory of 2532 2104 SandboxieInstall.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7a9ea533f97172e64ae9d8509d7eaa2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SandboxieInstall.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SandboxieInstall.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\SandboxieInstall-64-bit-259425232.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SandboxieInstall.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2532
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD55b177572876deecfaf985d58f95c87e9
SHA11f842e4ada6411e9714c8795594d15d0e1a00a00
SHA256df71616ced532cae532a85f3cec302173b24db37fcf2b3d7bb420a5d11adb0b8
SHA5122cda2f46dd7e9855d6b6af13b09a062b509feba2828ea96e9a164a470d965357fadf3a1bcf791bb932af3246626a703631df67899655ed621aed37d476e418db
-
Filesize
996B
MD51fb6ac36b264ed12f5bd1f82af581393
SHA1c4443c85637230bf56f8f50b23ab6696a1ea92d7
SHA256588b4ccec760a71c9664943ccbc77a5c7477c96befee3628f7968e6a65e4b31a
SHA512a874c467154f2fc5ce53fe0965702bede654b67fe4ea8c9114ca2efa7037ddc0044533166069d0ac9a5accaa7f5c279d5e552e42b4aefe3fe88651da09d71911
-
Filesize
11B
MD50e3d8689fe15096efc6561f65d39baa9
SHA16a00effcb4690f56b34f120f2c95b05487498957
SHA256fbbf44fd2a5ae30a553b34ea9f1c66ffba56c6da68f0bdf9d548a8f65dc4bc81
SHA51278e6bc378b2403c7a4d8147523a0d93b8cd624f5df4374e514e085ba9b47203eaf864d78b8f3d681d2e41db6087783734e708f9d1d199ff02c2b04141d56407a
-
Filesize
4KB
MD51178e882a8b44febf67d037cd0747647
SHA1060ac6885375585b9bfa15f037cd3067faabc47e
SHA256b506f106cb65c633e5a68c4d7c22d994bd5641e92653c3ee95ec40577aeeb38e
SHA5128835207cdc4756701bd40723c1c399da569131596b82d18a4a60eec1dd05af7dcf64e1660e2533fb910f5aca8f8ef3cd9a17c2a0af643be70dae09e1c14a4f40
-
Filesize
7KB
MD5fbe4bab53f74d3049ef4b306d4cd8742
SHA16504b63908997a71a65997fa31eda4ae4de013e7
SHA256446658dd5af649857fff445c600f26cdc1d0c19c86a080f312b89b1890182092
SHA512d458ab806a3ed3d1494a13ad8a75df874a0b227cb4f337996cb82df3c4a26dc9c4fe48a664b53b052a4af123ea8d89911d9d9493870e6b5992d5621a32260c2f
-
Filesize
424KB
MD5ebf5493e006a930bbe13f8288038fcb2
SHA15702fa165f4dfddae168f995af609ce242a771ec
SHA256a1cea7787e50d92ec3876c6442bfa892d442b4e5f1d3ee30e1fba77dc898fd7e
SHA5129723798fd0bb9d90ed17fa7fcd081aa2fb86ffb909ddeb13949a1e0e665a2fe6c52e49f0bd62dab798a0ce43a22611c6062d1baaec2ee50556ff92cfc732a39f
-
Filesize
24KB
MD5d8c9871b9803f4af30478ab6a414c905
SHA1178c96fdf686b773fdbe3b49ed9e9e4bfb581c80
SHA256af6dccd2563ec7505c5df2162ff3cb0a3b92480a42be854d0d8c6f943c065637
SHA51247af343293729c203ea612c2876d7c0b277e90756a08985f71456396d739fa4c47c5c606fb5b239aa484b2b916b17c468b23b315e6db5a6ef45a17c8d002cacc
-
Filesize
40KB
MD500964ea7511153e32c574024b77cd143
SHA1732effb9882b3adfa58cd76e3350c60bbf699bcc
SHA25613601d81f7cfc83c582d63825d7cb19b96cc82d29901bc214fc2ac3eff6748ac
SHA512a375ff591f3a169d587a65890c7cd0fed86023e68657cca1a0115671e475ad7056ec598c41ffaf57c7aae254545e9cea02ebf5f3bff8ae1bc9e4c5dc07095e2c
-
Filesize
1.1MB
MD55956bd9e6464505eed33890141fe92d7
SHA11fabbc2ee2b29cb61e1b321809b7da6667927f18
SHA25641380b072915bced1babed676f9a23c64d0ae2d2fdc7b98748a79ff393e0ae0c
SHA512d4778c9be0740aa3032cbc91f9f6a903c4dce98ca8ce39cb3ee3634dea73584850cdf46c43efe1a97f7d571da92d29db76e50d93defd4a4d227f90adbde8e6ed
-
Filesize
5KB
MD5a401e590877ef6c928d2a97c66157094
SHA175e24799cf67e789fadcc8b7fddefc72fdc4cd61
SHA2562a7f33ef64d666a42827c4dc377806ad97bc233819197adf9696aed5be5efac0
SHA5126093415cd090e69cdcb52b5d381d0a8b3e9e5479dac96be641e0071f1add26403b27a453febd8ccfd16393dc1caa03404a369c768a580781aba3068415ee993f
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667