Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 09:21
Static task
static1
Behavioral task
behavioral1
Sample
f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe
-
Size
606KB
-
MD5
f0badb4014d0e5a24ffbf4fcf269eb88
-
SHA1
e5f1633464f46d4d0aebb9e222d5883a4ceff3cf
-
SHA256
c01e5aaf7540b2117aabcbce7d07c18b89c1d86ff5e0e34d5422f3cd35a738a2
-
SHA512
af6c06dfbfd402cf1f5d475bf2a84c0ac4a1f1df60b56e95a533d77e770bfc6fa05bf80fd32d71f48c4afb99c05bb621a69e801be04eb7da86f483c65a8bf1b8
-
SSDEEP
12288:2OXXLhhs2XAFjgYZaOEOAHhly6T6ebnpSXVnf0U0SJvoqnuUD:ryTAVTVpu30SJvo+uU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2128 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
pid Process 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{0DD6A1A7-C626-48FB-A831-D3F137C02A01}\\f5ea51da.exe" f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2128 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 28 PID 2240 wrote to memory of 2128 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 28 PID 2240 wrote to memory of 2128 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 28 PID 2240 wrote to memory of 2128 2240 f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0badb4014d0e5a24ffbf4fcf269eb88_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD5d3a5a780aa57a4b621e48b396b52dbe9
SHA1f01d3314e8fc975b41258bca9ccb382d50cfc30e
SHA256f5fd4b1b4eb899190dd5f6722813773d786709f64907d4cb3b5b85ede105431a
SHA5122b1459c5f02a6a5a2ad6d8b3784991bbda4c54d614c7332edbed3766aabf92fefd4c5b6cce0a64de5aa43d3a770393a9551282e629a77716cc5d312a10185c17
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e