Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
13e9e7eff1842b232fb22505c7573560
-
SHA1
3e5196cf0757f7659763cafb310e2bb3ef208282
-
SHA256
cb4afb5203d651b213d0b6408f6b9199f11c76f1748264a89d2224999dd58916
-
SHA512
cdd9be0cdd5d9a43d7f07a7b8b2f84e3b342484603996a9f9aa9e4ca05ecb10312fd5f045ddb2f798cc31287c98dcf607bcd8fbfaa943ec48514dddff37d1bcb
-
SSDEEP
49152:yDTA7xU81kHR6gWakurxp9gKXcgBTC7WHI1xT:yD2Qcg47Wo15
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 2116 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 2116 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 2116 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 2116 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3048 wrote to memory of 3016 3048 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 28 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29 PID 3016 wrote to memory of 2116 3016 13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\13e9e7eff1842b232fb22505c7573560_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2116
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD531b53e645b54e41731bc85ede084d1c9
SHA1d99d23d8aec95f509d4875864e9812e7e4390d81
SHA2568cd6f3e2059818495e7b7767707fa82ed41e6d021a33d7ccb735733bf16bc770
SHA512663634b2f0be6ff72ff4f79d77cf2cd575b75b82b428739d8aef4d179b65eec4af20ddf683587792d6678bfe84e1273ab8c605a01facd7ed9479a96fd290e421
-
Filesize
200KB
MD53660f8372c6c90e343265bc9bea9babb
SHA1a109c3ace90504ee6d64061680023302cc756c6d
SHA2561efec680c299ccae36e8e68ca4f9da422feb81cad9b51fcba30adc59aac4c8f6
SHA51282decc6c73ba249fa425a0c5703df1d696bea9e549817e6102369fc34a4fb9276e92487a89cb081582eb36ae980ddff7f5413fe2d3327c113030d65d9f96a7e2
-
Filesize
494KB
MD5f0c59526f8186eadaf2171b8fd2967c1
SHA18ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA2566e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854
-
Filesize
5KB
MD544dac7f87bdf94d553f8d2cf073d605d
SHA121bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA2560e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA51292c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774