Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe
-
Size
227KB
-
MD5
ff865b56369afeee3a738ce2406e0fc9
-
SHA1
a8b9fd1d5b863c454325cc1f51e30a14ea2a28df
-
SHA256
97e78b98e54d5c2480c459ac2322aa5bdd0e684dac0c436eca4f66265a6eee92
-
SHA512
d373d5f6b36556dba1b35d0fe9202691d4a060966b98154004e462e2c6eca3cf712b4bcbb84c484dad2ed409d61d149745a4e107251fb74ed63279bfe518653a
-
SSDEEP
6144:zqFKBcr0l3pFBq+2GRuZM/lGVBvJgvhj:2FKaYNnB1H/loJ6j
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2944 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2580 welgrwdnyr.exe -
Loads dropped DLL 4 IoCs
pid Process 2944 cmd.exe 2944 cmd.exe 2580 welgrwdnyr.exe 2580 welgrwdnyr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2508 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2584 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 welgrwdnyr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2508 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2580 welgrwdnyr.exe 2580 welgrwdnyr.exe 2580 welgrwdnyr.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2580 welgrwdnyr.exe 2580 welgrwdnyr.exe 2580 welgrwdnyr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2944 1984 ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe 28 PID 1984 wrote to memory of 2944 1984 ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe 28 PID 1984 wrote to memory of 2944 1984 ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe 28 PID 1984 wrote to memory of 2944 1984 ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe 28 PID 2944 wrote to memory of 2508 2944 cmd.exe 30 PID 2944 wrote to memory of 2508 2944 cmd.exe 30 PID 2944 wrote to memory of 2508 2944 cmd.exe 30 PID 2944 wrote to memory of 2508 2944 cmd.exe 30 PID 2944 wrote to memory of 2584 2944 cmd.exe 32 PID 2944 wrote to memory of 2584 2944 cmd.exe 32 PID 2944 wrote to memory of 2584 2944 cmd.exe 32 PID 2944 wrote to memory of 2584 2944 cmd.exe 32 PID 2944 wrote to memory of 2580 2944 cmd.exe 33 PID 2944 wrote to memory of 2580 2944 cmd.exe 33 PID 2944 wrote to memory of 2580 2944 cmd.exe 33 PID 2944 wrote to memory of 2580 2944 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1984 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ff865b56369afeee3a738ce2406e0fc9_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\WELGRW~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 19843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2584
-
-
C:\Users\Admin\AppData\Local\welgrwdnyr.exeC:\Users\Admin\AppData\Local\WELGRW~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5ff865b56369afeee3a738ce2406e0fc9
SHA1a8b9fd1d5b863c454325cc1f51e30a14ea2a28df
SHA25697e78b98e54d5c2480c459ac2322aa5bdd0e684dac0c436eca4f66265a6eee92
SHA512d373d5f6b36556dba1b35d0fe9202691d4a060966b98154004e462e2c6eca3cf712b4bcbb84c484dad2ed409d61d149745a4e107251fb74ed63279bfe518653a