Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe
-
Size
363KB
-
MD5
f5ba72b6aacf6482382463f02af64435
-
SHA1
9a76a00699521e9ac435b714cbcc835743c4f84d
-
SHA256
49a128a45c1ba228d4fd5d972deaab2f1cfb87518a1a44752ec0fa2e4e02aeef
-
SHA512
ba22110d2aaf4d08ccfc15ffdff8d18e0c7c9905b4a990653d766a2ff243ccedbd6ad7910eae98e672984b6b8502eabf4249480b8d2444f662edfa047a73900c
-
SSDEEP
6144:SbIAyTXMQ7iBVJxRbq3gkKJFoXrQePZ3hH0WO1KgKyy:xTcSg77eoJFe8ehvyy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2340 zyjit.exe -
Loads dropped DLL 2 IoCs
pid Process 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\{8AB77948-8466-AD4E-E8B6-6988D6F14A95} = "C:\\Users\\Admin\\AppData\\Roaming\\Edezcy\\zyjit.exe" zyjit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2228 set thread context of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 -
Program crash 1 IoCs
pid pid_target Process procid_target 1832 2836 WerFault.exe 31 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Privacy f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe 2340 zyjit.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 2340 zyjit.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2340 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 30 PID 2228 wrote to memory of 2340 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 30 PID 2228 wrote to memory of 2340 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 30 PID 2228 wrote to memory of 2340 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 30 PID 2340 wrote to memory of 1104 2340 zyjit.exe 19 PID 2340 wrote to memory of 1104 2340 zyjit.exe 19 PID 2340 wrote to memory of 1104 2340 zyjit.exe 19 PID 2340 wrote to memory of 1104 2340 zyjit.exe 19 PID 2340 wrote to memory of 1104 2340 zyjit.exe 19 PID 2340 wrote to memory of 1176 2340 zyjit.exe 20 PID 2340 wrote to memory of 1176 2340 zyjit.exe 20 PID 2340 wrote to memory of 1176 2340 zyjit.exe 20 PID 2340 wrote to memory of 1176 2340 zyjit.exe 20 PID 2340 wrote to memory of 1176 2340 zyjit.exe 20 PID 2340 wrote to memory of 1212 2340 zyjit.exe 21 PID 2340 wrote to memory of 1212 2340 zyjit.exe 21 PID 2340 wrote to memory of 1212 2340 zyjit.exe 21 PID 2340 wrote to memory of 1212 2340 zyjit.exe 21 PID 2340 wrote to memory of 1212 2340 zyjit.exe 21 PID 2340 wrote to memory of 2416 2340 zyjit.exe 23 PID 2340 wrote to memory of 2416 2340 zyjit.exe 23 PID 2340 wrote to memory of 2416 2340 zyjit.exe 23 PID 2340 wrote to memory of 2416 2340 zyjit.exe 23 PID 2340 wrote to memory of 2416 2340 zyjit.exe 23 PID 2340 wrote to memory of 2564 2340 zyjit.exe 24 PID 2340 wrote to memory of 2564 2340 zyjit.exe 24 PID 2340 wrote to memory of 2564 2340 zyjit.exe 24 PID 2340 wrote to memory of 2564 2340 zyjit.exe 24 PID 2340 wrote to memory of 2564 2340 zyjit.exe 24 PID 2340 wrote to memory of 2228 2340 zyjit.exe 29 PID 2340 wrote to memory of 2228 2340 zyjit.exe 29 PID 2340 wrote to memory of 2228 2340 zyjit.exe 29 PID 2340 wrote to memory of 2228 2340 zyjit.exe 29 PID 2340 wrote to memory of 2228 2340 zyjit.exe 29 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2836 2228 f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe 31 PID 2836 wrote to memory of 1832 2836 cmd.exe 33 PID 2836 wrote to memory of 1832 2836 cmd.exe 33 PID 2836 wrote to memory of 1832 2836 cmd.exe 33 PID 2836 wrote to memory of 1832 2836 cmd.exe 33 PID 2340 wrote to memory of 1352 2340 zyjit.exe 32 PID 2340 wrote to memory of 1352 2340 zyjit.exe 32 PID 2340 wrote to memory of 1352 2340 zyjit.exe 32 PID 2340 wrote to memory of 1352 2340 zyjit.exe 32 PID 2340 wrote to memory of 1352 2340 zyjit.exe 32 PID 2340 wrote to memory of 1832 2340 zyjit.exe 33 PID 2340 wrote to memory of 1832 2340 zyjit.exe 33 PID 2340 wrote to memory of 1832 2340 zyjit.exe 33 PID 2340 wrote to memory of 1832 2340 zyjit.exe 33 PID 2340 wrote to memory of 1832 2340 zyjit.exe 33
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5ba72b6aacf6482382463f02af64435_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Roaming\Edezcy\zyjit.exe"C:\Users\Admin\AppData\Roaming\Edezcy\zyjit.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2340
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc0b31298.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 1164⤵
- Program crash
PID:1832
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:2416
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2564
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "71399132810781655084859718931047241920-809475152609241-1838016202493693602"1⤵PID:1352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD59be9d6eb9b359c86c192bf455b46162f
SHA19c60bb6ce0e3eb7c1880d6c6259a9d459d3aae01
SHA256dd1ecfaefb49f97ae1ba258ab875fdf4ff25ecca8324af6c4c208c443f1119ab
SHA5127e33ae4e097676d1e1b2a1fd08b71196d46ce1b9ef9c3eeb58988c8b69963c82a39e4ff2c4f21b9dfeea530a22de54df3727203cf60652b23263bdacf0015f34