Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 22:14
Behavioral task
behavioral1
Sample
21f2e57126003cafb21ce16423691176_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21f2e57126003cafb21ce16423691176_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
21f2e57126003cafb21ce16423691176_JaffaCakes118.exe
-
Size
853KB
-
MD5
21f2e57126003cafb21ce16423691176
-
SHA1
9fcec6147e41d338455aa6f5cb3c660f49ed8253
-
SHA256
166da6df0e1d99ed52aea45765d1d08872775a330de3602556969a684c127a23
-
SHA512
cb7ce662c03c372a049d41938e69d6caa6df03347726e035ce883d08b9bb9618c4f85ce249a55e6734d86a8194c92fc3c6f959d00f0b386bc36f69fbf5255a7c
-
SSDEEP
24576:o8IdW1fuTYrsxDuau+UqaeHLo9XHo9CSzCoQA/8pjZu+BokDP:o8EmWT8sxyqPE949CSggKA+io
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2136 setup.exe -
Loads dropped DLL 10 IoCs
pid Process 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe -
resource yara_rule behavioral1/memory/3020-0-0x00000000011E0000-0x000000000145E000-memory.dmp upx behavioral1/files/0x0036000000014594-2.dat upx behavioral1/memory/3020-4-0x0000000002860000-0x0000000002ADE000-memory.dmp upx behavioral1/memory/3020-9-0x00000000011E0000-0x000000000145E000-memory.dmp upx behavioral1/memory/2136-10-0x0000000000BE0000-0x0000000000E5E000-memory.dmp upx behavioral1/memory/2136-20-0x0000000000BE0000-0x0000000000E5E000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2672 2136 WerFault.exe 28 -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 2136 setup.exe 2136 setup.exe 2136 setup.exe 2136 setup.exe 2136 setup.exe 2136 setup.exe 2136 setup.exe 2136 setup.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2136 3020 21f2e57126003cafb21ce16423691176_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2672 2136 setup.exe 29 PID 2136 wrote to memory of 2672 2136 setup.exe 29 PID 2136 wrote to memory of 2672 2136 setup.exe 29 PID 2136 wrote to memory of 2672 2136 setup.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f2e57126003cafb21ce16423691176_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21f2e57126003cafb21ce16423691176_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 10803⤵
- Loads dropped DLL
- Program crash
PID:2672
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
853KB
MD521f2e57126003cafb21ce16423691176
SHA19fcec6147e41d338455aa6f5cb3c660f49ed8253
SHA256166da6df0e1d99ed52aea45765d1d08872775a330de3602556969a684c127a23
SHA512cb7ce662c03c372a049d41938e69d6caa6df03347726e035ce883d08b9bb9618c4f85ce249a55e6734d86a8194c92fc3c6f959d00f0b386bc36f69fbf5255a7c