Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe
-
Size
7.2MB
-
MD5
1541b6a648c72b344e6f10782252e794
-
SHA1
f31552f28d85c942e814ec2ef5d5ba32d014752e
-
SHA256
fe6ca4391ea8f2b7fa80586a8eb9bcea47cb854cf77df05209e9df2ff61caa62
-
SHA512
0e7ba38616ef33f4d7f587cc56089fab064574ee3c458d097750ffbec7f692bdcaf7b7ab748412d413fed713053fa3f441aa740ea005cbde6c08225ee49861b5
-
SSDEEP
196608:TNcvvcqt7OB9qT8Cfem9J4Te4HAs8viK82ADoON+O3:+X4OWmf4TAs8qKaMOQO3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2996 is-TKV2I.tmp -
Loads dropped DLL 4 IoCs
pid Process 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 2996 is-TKV2I.tmp 2996 is-TKV2I.tmp 2996 is-TKV2I.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2996 is-TKV2I.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2996 2136 1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\is-PDHV7.tmp\is-TKV2I.tmp"C:\Users\Admin\AppData\Local\Temp\is-PDHV7.tmp\is-TKV2I.tmp" /SL4 $30098 "C:\Users\Admin\AppData\Local\Temp\1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe" 7345491 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
656KB
MD54fa180886ff7c0fd86a65f760ede6318
SHA12c89c271c71531362e84ddab5d3028f0756a9281
SHA2561d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c
SHA512a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd