Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe
-
Size
33KB
-
MD5
fa33c5fd62cb1a2f3077dceea84f441e
-
SHA1
419891ae4bff67b7c321e0d1b650926525c3c122
-
SHA256
77722664a92042f699f0a7a8de15a0c553ecaa152d3099bf33a7beb3d4790602
-
SHA512
cd176079d506cac51a619033e419a13bc83a8122319338b6cb895ee3157eae17d238812f35acaa58a074ed6e360ee0197fa1b6228d0081d2cfaf1772df8c2af4
-
SSDEEP
768:6lz/yURinnljkQHMBQig88QE2vjKpCgJ6Xp6s/wJJn5Pu:izj4loW/INYCgJc0JJo
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe Token: SeBackupPrivilege 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2912 2792 fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe 28 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2912 wrote to memory of 2580 2912 cmd.exe 30 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2580 wrote to memory of 2652 2580 cmd.exe 32 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2652 wrote to memory of 2656 2652 net.exe 33 PID 2580 wrote to memory of 2720 2580 cmd.exe 34 PID 2580 wrote to memory of 2720 2580 cmd.exe 34 PID 2580 wrote to memory of 2720 2580 cmd.exe 34 PID 2580 wrote to memory of 2720 2580 cmd.exe 34 PID 2580 wrote to memory of 2720 2580 cmd.exe 34 PID 2580 wrote to memory of 2720 2580 cmd.exe 34 PID 2580 wrote to memory of 2720 2580 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\dt.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K c:\windows\temp\r.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess4⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess5⤵PID:2656
-
-
-
C:\Windows\SysWOW64\ftp.exeftp -s:c:\windows\temp\f.txt4⤵PID:2720
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5676afdfa824e13b72aecaf6d0d65fa6c
SHA1f5e918c9fe29a9b432be38b812a6087f4a49bff2
SHA256896520460c090bcacba8cf6f633abf2e4c6e01c8284737b60b1f51063246e72a
SHA5124ac34dd1eb77862206dc608c9b57e2956857407b7c5eced45c20b6577e2d53755254fd38300a2b7d02624c37a652ade86add230cd33c452bec380688f414f633
-
Filesize
76B
MD5e492c90155bb26e6c57c202780f35093
SHA183d3d0a8af4fbcd3b70a22611578ef5b5966fcb9
SHA256ff07e608a348217c1306a1ff202f9b91fddf104b9367c4ee911bccefe04edb94
SHA512b3265b4f58966441813a0da9032d68e061dcbe6213f82b10f83addafe93627d66637105b443534fac8e074340ff50e07e14437309ad88befc774d2daf5286259
-
Filesize
164B
MD5f22ad73544c4463a4fe267ed2c646a20
SHA19faba5662a5f43fad4df2182fb3c45199cd316c8
SHA256188e171e17dad12fa1b8067a8b86bc113c0f9df9d9ef03e89006f9c3f7c51c98
SHA5122c52ceee850adbb90863452815d60596931c485c921ef1a7c3ed8d0de028cbbfc561d62e25beb63410e867da63ebfef6c7cf0f2d1cb75fe13e566731f4df2abd