Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe
-
Size
24KB
-
MD5
f20d9ab7c5d6b3373f05f38a7ba27564
-
SHA1
909c30410ea7720ca2b598872bc3f9d5236b9234
-
SHA256
17ee72c3297c4ee85ff6e7d4e42bae31b81e1cf671f8fa04a57b137cf74b77eb
-
SHA512
54340eef8a07e15b5faf22ae326facacd4bf472210167df0b76214b0a150c32aacb8a39f427f27864814af8547b22903b0b6b1d2bdf9b5053ca1013dc8478384
-
SSDEEP
384:E3eVES+/xwGkRKJvGkzlM61qmTTMVF9/q5E0:bGS+ZfbJXO8qYoAl
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2508 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2756 ipconfig.exe 2100 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2508 tasklist.exe Token: SeDebugPrivilege 2100 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2128 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 2128 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1260 2128 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 28 PID 2128 wrote to memory of 1260 2128 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 28 PID 2128 wrote to memory of 1260 2128 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 28 PID 2128 wrote to memory of 1260 2128 f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe 28 PID 1260 wrote to memory of 2188 1260 cmd.exe 30 PID 1260 wrote to memory of 2188 1260 cmd.exe 30 PID 1260 wrote to memory of 2188 1260 cmd.exe 30 PID 1260 wrote to memory of 2188 1260 cmd.exe 30 PID 1260 wrote to memory of 2756 1260 cmd.exe 31 PID 1260 wrote to memory of 2756 1260 cmd.exe 31 PID 1260 wrote to memory of 2756 1260 cmd.exe 31 PID 1260 wrote to memory of 2756 1260 cmd.exe 31 PID 1260 wrote to memory of 2508 1260 cmd.exe 32 PID 1260 wrote to memory of 2508 1260 cmd.exe 32 PID 1260 wrote to memory of 2508 1260 cmd.exe 32 PID 1260 wrote to memory of 2508 1260 cmd.exe 32 PID 1260 wrote to memory of 2612 1260 cmd.exe 34 PID 1260 wrote to memory of 2612 1260 cmd.exe 34 PID 1260 wrote to memory of 2612 1260 cmd.exe 34 PID 1260 wrote to memory of 2612 1260 cmd.exe 34 PID 2612 wrote to memory of 2656 2612 net.exe 35 PID 2612 wrote to memory of 2656 2612 net.exe 35 PID 2612 wrote to memory of 2656 2612 net.exe 35 PID 2612 wrote to memory of 2656 2612 net.exe 35 PID 1260 wrote to memory of 2100 1260 cmd.exe 36 PID 1260 wrote to memory of 2100 1260 cmd.exe 36 PID 1260 wrote to memory of 2100 1260 cmd.exe 36 PID 1260 wrote to memory of 2100 1260 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f20d9ab7c5d6b3373f05f38a7ba27564_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2188
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2756
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2656
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5fc22c7e0dad58913ec2b14b22f780888
SHA1abdbd732310f2a29002d585074136dca1a2c3d97
SHA25623c17f2bfdbe229cfe78408e37980a1f29e8cb55086c843ad2214e4e342052ee
SHA5127d32a0b57b75cbd2edae56f2b50a8bdd5105ea316bb870feda47b7033ea3fbba8739c7bc5a2052a8a600559509644808a11fc0be1f888ca08260e5dd32e92ba4