Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
00ded89e01e5485b62fdcba45e18ffde_JaffaCakes118.jad
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00ded89e01e5485b62fdcba45e18ffde_JaffaCakes118.jad
Resource
win10v2004-20240419-en
General
-
Target
00ded89e01e5485b62fdcba45e18ffde_JaffaCakes118.jad
-
Size
1.4MB
-
MD5
00ded89e01e5485b62fdcba45e18ffde
-
SHA1
3c1594b7a61b7e22c78deae1cd279f4464f7ba8e
-
SHA256
337ad1cc414156eafefcd8c924c39ec06184acae87798ed0b11ce310022dfab9
-
SHA512
78b9ec825a01c7f6feb22b85fc1adcf38d27a88919e2a75f145fa048330e85e8ec10afa31bf8463d3774147ac818d587b62e346cf4d2e3973d25c0aa5137115a
-
SSDEEP
24576:K0p6PfcBN/Si6H3sy+RG+IH0+FYiCPGlFoL35TVYgNpl1ypqPPmu2zBi7dFgkwWN:5kncBtSjXuG+0eGry5xNlypqPcNiTdxN
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jad rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jad\ = "jad_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2900 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2900 AcroRd32.exe 2900 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2612 1936 cmd.exe 29 PID 1936 wrote to memory of 2612 1936 cmd.exe 29 PID 1936 wrote to memory of 2612 1936 cmd.exe 29 PID 2612 wrote to memory of 2900 2612 rundll32.exe 30 PID 2612 wrote to memory of 2900 2612 rundll32.exe 30 PID 2612 wrote to memory of 2900 2612 rundll32.exe 30 PID 2612 wrote to memory of 2900 2612 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\00ded89e01e5485b62fdcba45e18ffde_JaffaCakes118.jad1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\00ded89e01e5485b62fdcba45e18ffde_JaffaCakes118.jad2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\00ded89e01e5485b62fdcba45e18ffde_JaffaCakes118.jad"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57dbd0c0c7da8297ebe75978e5f360b9d
SHA1e0bfc092cb2299bfa52ce102941e5dffa5482376
SHA25651e71d05f8643c595ad3f91948bb3540f9e5aec44c6c719185c5780cee705fe4
SHA5129e4ade1554d95cad01ef395f1d2e01544bcf84a1b43ccf9479f6d9186a9e8eaff077dd5791e0302ec73c8369b14526ea85d5d46b249c25a12d6bf6e77a4cea01