Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 06:53
Behavioral task
behavioral1
Sample
f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
General
-
Target
f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe
-
Size
134KB
-
MD5
f2ef5cde02e79c38338e7bb163d63b5f
-
SHA1
3d272166feefc6bf275182bf57c9d12fc0bd5fcc
-
SHA256
ff1a30e56965197f69bb88572482f53816230b416924d30097dcce9bcb0c32ee
-
SHA512
086b88e9385419978f04f6a8a3d0dc7ebd8b8c66ac99d2218b8f9b2398d9e2ed51d49ec4587e451ea19ce156e1f7c0dfd624b025dc182936b9d0c3cfc962203b
-
SSDEEP
3072:MMwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwK5iGHeqovv:M3JVGpxx9b3wZuwK4GHeqo
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000e00000001329e-5.dat family_gh0strat behavioral1/files/0x000a00000001220d-10.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 2972 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe File created C:\Windows\FileName.jpg f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe 2972 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeBackupPrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeBackupPrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeBackupPrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 1960 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:2972
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD56be72d4ad0a31518eb3b3b819cfd5b9b
SHA1314beb3e971046d636cbb2d55c8c48000f62d9fe
SHA256193f711c4563a59608047a6326a396631536bcf0bc6a01e1a9b28cdb380d3861
SHA51243dbe3f541c9a9604c9f11a79112a0c3f22ec5701167d08558ec8392f7b07a9ab769c3c623b6085cb3fa00664687331daa929dcd3274a265d7261e0d024cc59c
-
Filesize
13.3MB
MD5fa205b5be99fb76d5b8a5ae60a8fa392
SHA14a81249d052fec2f03a33e2ce66b3f4fcf3e3305
SHA256a599dba2dad9b0bd4070d751fc102a6d20f4b244d64f96ba2480992c30620e10
SHA51255587bf97416cf13e8bc988c9aadd74494dc468519deb615660787877c513bfcefdc725d86ed87d84bffee634bf0584ebf511fc62f5bf2759545ed9d456a5e9b
-
Filesize
99B
MD5eada2345597d90898ee9f3d904cb4b42
SHA1d9a2aa63a9e86b135c8dac65dbf08c55b7fed792
SHA2560dc6ffbeb8ee0e78e7c136379b266f0ac70e1b3e686cc2a02fcba95018c5bce8
SHA5128233f45b5cc0ad8861666ab10ae01e474cefa3d8cbab34700d92fc068b86620bf9a83ef4fe22c7b64371291b3e16507b60b453295da9479336d1f7a3d287799b
