Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe
-
Size
276KB
-
MD5
fdb6031dfc0ce88e4071eed944b60743
-
SHA1
26e6c7a7db7e3eca2206782fdf7e6207f38ca3e6
-
SHA256
2195c99cc40bc19bca3d3e29c75681104e47d1dfee722b2260196f30f5addf8b
-
SHA512
df7483403e7fa7bc32e44493268ab53b08c35b8c25dd382a6071cd72029382251681fcd5be589bee2dceab039d0601507c8b567b01a7772ad87b18527c1b5bc4
-
SSDEEP
6144:6nxg/DcalVaZNo4way/WTT42T6A+X1XPXwehGREcm:6xg/QsVaZN8aya45Bhf2
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 904 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3024 fwomkdy.exe -
Loads dropped DLL 4 IoCs
pid Process 904 cmd.exe 904 cmd.exe 3024 fwomkdy.exe 3024 fwomkdy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2112 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2672 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 fwomkdy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2112 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3024 fwomkdy.exe 3024 fwomkdy.exe 3024 fwomkdy.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3024 fwomkdy.exe 3024 fwomkdy.exe 3024 fwomkdy.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2364 wrote to memory of 904 2364 fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe 28 PID 2364 wrote to memory of 904 2364 fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe 28 PID 2364 wrote to memory of 904 2364 fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe 28 PID 2364 wrote to memory of 904 2364 fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe 28 PID 904 wrote to memory of 2112 904 cmd.exe 30 PID 904 wrote to memory of 2112 904 cmd.exe 30 PID 904 wrote to memory of 2112 904 cmd.exe 30 PID 904 wrote to memory of 2112 904 cmd.exe 30 PID 904 wrote to memory of 2672 904 cmd.exe 32 PID 904 wrote to memory of 2672 904 cmd.exe 32 PID 904 wrote to memory of 2672 904 cmd.exe 32 PID 904 wrote to memory of 2672 904 cmd.exe 32 PID 904 wrote to memory of 3024 904 cmd.exe 33 PID 904 wrote to memory of 3024 904 cmd.exe 33 PID 904 wrote to memory of 3024 904 cmd.exe 33 PID 904 wrote to memory of 3024 904 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2364 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fdb6031dfc0ce88e4071eed944b60743_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\fwomkdy.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 23643⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2672
-
-
C:\Users\Admin\AppData\Local\fwomkdy.exeC:\Users\Admin\AppData\Local\fwomkdy.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5fdb6031dfc0ce88e4071eed944b60743
SHA126e6c7a7db7e3eca2206782fdf7e6207f38ca3e6
SHA2562195c99cc40bc19bca3d3e29c75681104e47d1dfee722b2260196f30f5addf8b
SHA512df7483403e7fa7bc32e44493268ab53b08c35b8c25dd382a6071cd72029382251681fcd5be589bee2dceab039d0601507c8b567b01a7772ad87b18527c1b5bc4