Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe
-
Size
171KB
-
MD5
ff077fb7a3411abdfc789d4f31d7f78a
-
SHA1
5277533eac75a1faf0aee629d503677cb0bf5c43
-
SHA256
8d0ae5498987df62ff128ba2c4bf1085e654d6e1ad6b42fcca97f63af003bc5e
-
SHA512
9f90948dbc8a1bfd1ea902829b378eefe32fbb05827d9b03c913f7764c4888518a0a71863dbfb1cfa4abbd6a0c3af057bd9e9dbb3ffa87ae92840eb74c70d690
-
SSDEEP
3072:tbWdfgET6RzbRa9F7FDf6YbEqaVwwnhBDCf9maAprvln/d3aoDeMaJ6K+0rzn06i:pWd7QHmh+YbEqaVwwPe1mprd/laoDTak
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2884 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2688 lguystfp.exe -
Loads dropped DLL 4 IoCs
pid Process 2884 cmd.exe 2884 cmd.exe 2688 lguystfp.exe 2688 lguystfp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3044 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2584 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2688 lguystfp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3044 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2688 lguystfp.exe 2688 lguystfp.exe 2688 lguystfp.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2688 lguystfp.exe 2688 lguystfp.exe 2688 lguystfp.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2884 2184 ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe 28 PID 2184 wrote to memory of 2884 2184 ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe 28 PID 2184 wrote to memory of 2884 2184 ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe 28 PID 2184 wrote to memory of 2884 2184 ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe 28 PID 2884 wrote to memory of 3044 2884 cmd.exe 30 PID 2884 wrote to memory of 3044 2884 cmd.exe 30 PID 2884 wrote to memory of 3044 2884 cmd.exe 30 PID 2884 wrote to memory of 3044 2884 cmd.exe 30 PID 2884 wrote to memory of 2584 2884 cmd.exe 32 PID 2884 wrote to memory of 2584 2884 cmd.exe 32 PID 2884 wrote to memory of 2584 2884 cmd.exe 32 PID 2884 wrote to memory of 2584 2884 cmd.exe 32 PID 2884 wrote to memory of 2688 2884 cmd.exe 33 PID 2884 wrote to memory of 2688 2884 cmd.exe 33 PID 2884 wrote to memory of 2688 2884 cmd.exe 33 PID 2884 wrote to memory of 2688 2884 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2184 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ff077fb7a3411abdfc789d4f31d7f78a_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\lguystfp.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 21843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2584
-
-
C:\Users\Admin\AppData\Local\lguystfp.exeC:\Users\Admin\AppData\Local\lguystfp.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD5ff077fb7a3411abdfc789d4f31d7f78a
SHA15277533eac75a1faf0aee629d503677cb0bf5c43
SHA2568d0ae5498987df62ff128ba2c4bf1085e654d6e1ad6b42fcca97f63af003bc5e
SHA5129f90948dbc8a1bfd1ea902829b378eefe32fbb05827d9b03c913f7764c4888518a0a71863dbfb1cfa4abbd6a0c3af057bd9e9dbb3ffa87ae92840eb74c70d690