Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 05:28
Behavioral task
behavioral1
Sample
f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe
Resource
win7-20240319-en
windows7-x64
General
-
Target
f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe
-
Size
127KB
-
MD5
f999f6d00546aee2ccb098d269ba6343
-
SHA1
6cb839e46fd963ec8b52f11c81e8e6a6ea9fcc91
-
SHA256
de3ba37b4c73b12963bf496aa5c13dbaf88c15ce7a97dbb112b8f5436d9d3157
-
SHA512
1117001f3a1a2c573e16cd7ab86bf9343db64c5a48e07524196b81341a9e3d904e91e6234961eb84ca569de3aead74195da79daeb883bb651d049156ff9a05e8
-
SSDEEP
3072:n7CaO7x8fC8t52oje+rKttHkoIIu6kfif20wNA:n7pON8ao6+wKodjkqfXC
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x001c0000000145e0-5.dat family_gh0strat behavioral1/files/0x000b0000000121c5-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 1716 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 1716 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bwxy\Gwxyabcde.gif f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe File created C:\Program Files (x86)\Bwxy\Gwxyabcde.gif f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeBackupPrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeBackupPrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeBackupPrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 2124 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1716
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD57a5449088bf5920fd891b438e6179889
SHA1337c0a27eadc4b1a6f7949dfb6e181508a33daaa
SHA256613b890500e680923769cd2dde4269562ac364bb949be166bf7cfb9a37941779
SHA5126e0b04bc13986c0f82413922a0d3854f7d87308b8fab2fbe9422f8554076bc90628abc1f772cfa4003485c10c0789826339a091bf9fe3e2167dffdd87350ef3a
-
Filesize
10.9MB
MD52ff5fedca7e1191fedd46c468e242950
SHA135326e2633e7de27b25e38499bae0abfa455e2e0
SHA2567cb06a0bf50c45aa6771ab7dca9f224da2f2264b5eb0dbf5af27e2034b273c87
SHA51213b6fac0c0e8b643fc5073a8490210775f04db4eab3dc01be23bbcfb30298eee40e597f753226455b60ac234b2e941628de9098ae21990b3b76ff2a042cba8f9
-
Filesize
99B
MD56fe486823fb3c5e36127647e8543094b
SHA1510f876cc202f0675882caaee41698f371c91c29
SHA256cb3295d398a80c0665e20554ab032d71793b4c361e432861d1cb0298245bcc1b
SHA51261d636d9373b9dcd71a664f9dde69fce2c3cfc39eb1357026bf25301cb3311af8a17250f167e93b535c303cff56f82e95ec4cbf959febaddfeef043882b02ab3
