Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
0834cd339c8950d5363909c48c991a76
-
SHA1
409e1f1952ebe4e0797502f451de3cd984774e28
-
SHA256
492e2c553a5c450393f9f412eccbcacbe0d3eed1f6234a4fde6aff524cb21dee
-
SHA512
3c408c9f08da2c85cbf9a615f60cca567d430d73cec49bb923fbaca2509a80734d959b2251c945bba49e7cd1c52c22de33892259075447f5a6045c28f5426464
-
SSDEEP
24576:VoWkVPVKUJ9Zt2oSrUcw0iw0O2eiWzt8yO1nvi3HemPSeRUv4sy/zd4a2ppu:G/B7CoyQw02iwRO1nK3HNSeRgEZF
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1708-29-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/1708-31-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/1708-33-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/1708-32-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/1708-30-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/1708-34-0x0000000000400000-0x000000000063E000-memory.dmp upx behavioral1/memory/1708-39-0x0000000000400000-0x000000000063E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe" 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1708 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2004 set thread context of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2248 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 28 PID 2004 wrote to memory of 2248 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 28 PID 2004 wrote to memory of 2248 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 28 PID 2004 wrote to memory of 2248 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 28 PID 2004 wrote to memory of 2244 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2244 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2244 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2244 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 29 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30 PID 2004 wrote to memory of 1708 2004 0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"2⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"2⤵PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0834cd339c8950d5363909c48c991a76_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1708
-