Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
fc81b118b986d065514814c62ce2959c_JaffaCakes118.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc81b118b986d065514814c62ce2959c_JaffaCakes118.js
Resource
win10v2004-20240412-en
General
-
Target
fc81b118b986d065514814c62ce2959c_JaffaCakes118.js
-
Size
199KB
-
MD5
fc81b118b986d065514814c62ce2959c
-
SHA1
a8c1ed074cc533c5aa6b71a3a527ffbc0493e225
-
SHA256
8b89ccf2aeee269572578f39cbe44d8b9eb1e90d6625be8bb005cc5296abc629
-
SHA512
5bf826d4cfbdd6613e4955d4eee3ef0851ad48f0ab3c8eada4c4d57b0b815af8e854d08a95eaf196316fd91f8c84aa2ec7ed5cfef8913757c19ea077e3c4a6e7
-
SSDEEP
3072:lritC+1MYgCc1doOgng49ooBP/GmhWi5eTIQ+vZzMd3efZeb9sHts649mPnhXe:4ggnTWq/TH1AsW6Ksle
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QUKoVKgJQp.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QUKoVKgJQp.js WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\QUKoVKgJQp.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2944 2896 wscript.exe 28 PID 2896 wrote to memory of 2944 2896 wscript.exe 28 PID 2896 wrote to memory of 2944 2896 wscript.exe 28 PID 2896 wrote to memory of 2996 2896 wscript.exe 29 PID 2896 wrote to memory of 2996 2896 wscript.exe 29 PID 2896 wrote to memory of 2996 2896 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\fc81b118b986d065514814c62ce2959c_JaffaCakes118.js1⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\QUKoVKgJQp.js"2⤵
- Drops startup file
- Adds Run key to start application
PID:2944
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dnituvvj.txt"2⤵PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD520db8f29d1db93e67b8b2ad6196d9e37
SHA1ce499527cae2ea611057d5dc952132b0d948eba4
SHA256349e780cca53f741459e1da002e177b536bf4eb7c69f5d3efaa6c4287bcfa985
SHA51271950c00ace082834e8b13ccc869a5d13c1ee0fe83e170ea3714b0a4279bad2d560f2dd6c2f200bddd4a00b241ff6553db9f6c8156cda7b60f0c08629512bfd3
-
Filesize
89KB
MD57873269dd388d4ff3dbe9f020e121e89
SHA1d50b0740bab0ebc4cf6b3cc4c586632f6dc9e13e
SHA256bc12cbf509a1f5bff1dea9896aae44b9bc119115bf38349f6caabbbf99e0e919
SHA51236fdd31209b3448dc32100f733c048b063521bade50a5dd8a3945b7acc5b504115036a6c37bf37ac99b31cf4f94a63b7040224bcf5d8b0c3d2bc93e4bb0fc818