Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
-
Size
59KB
-
MD5
ebd2eeb6c62f12f11f1575c74bbc1d6a
-
SHA1
68259fbd1936268e78779f1634970d574d677a36
-
SHA256
bc27f9ca4f1a712de85b14a5dc8c960cd5e7a155a5e4b82d1c902a9638991d2d
-
SHA512
64dce2109a32dafb6d50c061e5aa421feea37deb1840ecb6846c1a970424bcf5c130c2409b1decf815f2914479973e50f5f52100c794ff42bd73db441cbf8eee
-
SSDEEP
1536:RKSQdiVKKCdp/gc8O9Lj2K8tf+wZRKopW:85uKNdp/gD6YZ+AU5
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Runtime\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\dgohgr.dll" ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\Runtime\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\dgohgr.dll" ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\Runtime\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\dgohgr.dll" ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2132 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2480 ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe 2132 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\000540fe.001 ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe File created C:\Windows\SysWOW64\dgohgr.dll ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd2eeb6c62f12f11f1575c74bbc1d6a_JaffaCakes118.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:2480
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k Runtime1⤵
- Deletes itself
- Loads dropped DLL
PID:2132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD509a6c8caccd64da2bc0b022603754ed4
SHA16bc73f5f7d51098720c8d29c026ba6a859f7243e
SHA256446d41b3eaf1d56db1226ce851e6f596aae780d2fc5dc458bfb24798ec7d79f6
SHA512e8e14e57bdc4e8b91d881dc7203be87a7d5522cd92902451ed2beb90a56449fdf56aee68de7c72a2af9f48b30f15365084632fe6e588608810ca10535a7421d8