Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 09:13
Static task
static1
Behavioral task
behavioral1
Sample
2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/awqcm.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/awqcm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe
-
Size
557KB
-
MD5
2e6503294a603a34707cf57c20d31a23
-
SHA1
b2c70f2282e9bf0701b4b427bfde86c1d90c2013
-
SHA256
209dd9c494e998a20ef1e4e8c919182751ad0465916246b467a08815a591d37b
-
SHA512
c14ee8b86e31bd9f36086f604cbd0c7e1c419851b1c0a56f0a5369f4faf2acd40a298067a73a74d5d0eb6c997d7ad5bdc372d45d420d822f2f9dab0818fe5489
-
SSDEEP
12288:TzbIXVXQ20G2x2eaHP8xWVEabZGwMmMTkkYbQQVttiL9KonkSIIjA:Tz0XFQfG2EeQ0gEaNaThYhfSsIc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1296 ebbcabfbcdgg.exe -
Loads dropped DLL 10 IoCs
pid Process 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2868 1296 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2196 wmic.exe Token: SeSecurityPrivilege 2196 wmic.exe Token: SeTakeOwnershipPrivilege 2196 wmic.exe Token: SeLoadDriverPrivilege 2196 wmic.exe Token: SeSystemProfilePrivilege 2196 wmic.exe Token: SeSystemtimePrivilege 2196 wmic.exe Token: SeProfSingleProcessPrivilege 2196 wmic.exe Token: SeIncBasePriorityPrivilege 2196 wmic.exe Token: SeCreatePagefilePrivilege 2196 wmic.exe Token: SeBackupPrivilege 2196 wmic.exe Token: SeRestorePrivilege 2196 wmic.exe Token: SeShutdownPrivilege 2196 wmic.exe Token: SeDebugPrivilege 2196 wmic.exe Token: SeSystemEnvironmentPrivilege 2196 wmic.exe Token: SeRemoteShutdownPrivilege 2196 wmic.exe Token: SeUndockPrivilege 2196 wmic.exe Token: SeManageVolumePrivilege 2196 wmic.exe Token: 33 2196 wmic.exe Token: 34 2196 wmic.exe Token: 35 2196 wmic.exe Token: SeIncreaseQuotaPrivilege 2196 wmic.exe Token: SeSecurityPrivilege 2196 wmic.exe Token: SeTakeOwnershipPrivilege 2196 wmic.exe Token: SeLoadDriverPrivilege 2196 wmic.exe Token: SeSystemProfilePrivilege 2196 wmic.exe Token: SeSystemtimePrivilege 2196 wmic.exe Token: SeProfSingleProcessPrivilege 2196 wmic.exe Token: SeIncBasePriorityPrivilege 2196 wmic.exe Token: SeCreatePagefilePrivilege 2196 wmic.exe Token: SeBackupPrivilege 2196 wmic.exe Token: SeRestorePrivilege 2196 wmic.exe Token: SeShutdownPrivilege 2196 wmic.exe Token: SeDebugPrivilege 2196 wmic.exe Token: SeSystemEnvironmentPrivilege 2196 wmic.exe Token: SeRemoteShutdownPrivilege 2196 wmic.exe Token: SeUndockPrivilege 2196 wmic.exe Token: SeManageVolumePrivilege 2196 wmic.exe Token: 33 2196 wmic.exe Token: 34 2196 wmic.exe Token: 35 2196 wmic.exe Token: SeIncreaseQuotaPrivilege 2500 wmic.exe Token: SeSecurityPrivilege 2500 wmic.exe Token: SeTakeOwnershipPrivilege 2500 wmic.exe Token: SeLoadDriverPrivilege 2500 wmic.exe Token: SeSystemProfilePrivilege 2500 wmic.exe Token: SeSystemtimePrivilege 2500 wmic.exe Token: SeProfSingleProcessPrivilege 2500 wmic.exe Token: SeIncBasePriorityPrivilege 2500 wmic.exe Token: SeCreatePagefilePrivilege 2500 wmic.exe Token: SeBackupPrivilege 2500 wmic.exe Token: SeRestorePrivilege 2500 wmic.exe Token: SeShutdownPrivilege 2500 wmic.exe Token: SeDebugPrivilege 2500 wmic.exe Token: SeSystemEnvironmentPrivilege 2500 wmic.exe Token: SeRemoteShutdownPrivilege 2500 wmic.exe Token: SeUndockPrivilege 2500 wmic.exe Token: SeManageVolumePrivilege 2500 wmic.exe Token: 33 2500 wmic.exe Token: 34 2500 wmic.exe Token: 35 2500 wmic.exe Token: SeIncreaseQuotaPrivilege 2644 wmic.exe Token: SeSecurityPrivilege 2644 wmic.exe Token: SeTakeOwnershipPrivilege 2644 wmic.exe Token: SeLoadDriverPrivilege 2644 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1296 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 28 PID 2032 wrote to memory of 1296 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 28 PID 2032 wrote to memory of 1296 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 28 PID 2032 wrote to memory of 1296 2032 2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe 28 PID 1296 wrote to memory of 2196 1296 ebbcabfbcdgg.exe 29 PID 1296 wrote to memory of 2196 1296 ebbcabfbcdgg.exe 29 PID 1296 wrote to memory of 2196 1296 ebbcabfbcdgg.exe 29 PID 1296 wrote to memory of 2196 1296 ebbcabfbcdgg.exe 29 PID 1296 wrote to memory of 2500 1296 ebbcabfbcdgg.exe 32 PID 1296 wrote to memory of 2500 1296 ebbcabfbcdgg.exe 32 PID 1296 wrote to memory of 2500 1296 ebbcabfbcdgg.exe 32 PID 1296 wrote to memory of 2500 1296 ebbcabfbcdgg.exe 32 PID 1296 wrote to memory of 2644 1296 ebbcabfbcdgg.exe 34 PID 1296 wrote to memory of 2644 1296 ebbcabfbcdgg.exe 34 PID 1296 wrote to memory of 2644 1296 ebbcabfbcdgg.exe 34 PID 1296 wrote to memory of 2644 1296 ebbcabfbcdgg.exe 34 PID 1296 wrote to memory of 2156 1296 ebbcabfbcdgg.exe 36 PID 1296 wrote to memory of 2156 1296 ebbcabfbcdgg.exe 36 PID 1296 wrote to memory of 2156 1296 ebbcabfbcdgg.exe 36 PID 1296 wrote to memory of 2156 1296 ebbcabfbcdgg.exe 36 PID 1296 wrote to memory of 2488 1296 ebbcabfbcdgg.exe 38 PID 1296 wrote to memory of 2488 1296 ebbcabfbcdgg.exe 38 PID 1296 wrote to memory of 2488 1296 ebbcabfbcdgg.exe 38 PID 1296 wrote to memory of 2488 1296 ebbcabfbcdgg.exe 38 PID 1296 wrote to memory of 2868 1296 ebbcabfbcdgg.exe 40 PID 1296 wrote to memory of 2868 1296 ebbcabfbcdgg.exe 40 PID 1296 wrote to memory of 2868 1296 ebbcabfbcdgg.exe 40 PID 1296 wrote to memory of 2868 1296 ebbcabfbcdgg.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\ebbcabfbcdgg.exeC:\Users\Admin\AppData\Local\Temp\ebbcabfbcdgg.exe 0-9-5-1-9-7-0-6-4-7-4 L0dEQzQqMywyLhwvSlBBR0JENywZK048T1ZGS0tDQDYtICY/SEpNST45KjQ5LisfJjxJPjkpHC9HTU47TkNOW0JAPSgzMCkyIClPPk5WPE1eTEtMN2RtcHAxKi5qa3YoQD5PSyRPTkcmQUpMJ0VOPUofJjxMQz9ERUQ0Gy47Kj0sLhkrRCk4LCgZLz4vNikxFypDKzYtKxwoQDU0KDAXKFBMSz1RQ0taT0lCVjs/UjkgJktRRj1VPVBYQVVDPDwXKFBMSz1RQ0taTThGRTdlZl1nXFpsWGx0X25iamdWXG9gWHYsWylbaWRcb2BvMlksWGJvaVp2YGdkaXNsWzcXKkRPPl9PTkU5ICZAVzxYQ0dARUVOPDgfJkFPTVBYPlJGUlI8Sz0sHChQSDhJSlBIVVlRS0g9FypVRDYyGis9TzE0Gy5JTk5ORUZBX05ASzpITT9FRj1HPFBRQzYgKUVMW1JMSVNARkU3cGtxZRcqUTxNVUxKQkpHVlBSPEtfPj1STz0pGy4/QkQ/VDYtICZEUlY9WUg9RkVDVkBNOktZSlA+QD1dXGtqXiApQEhTTkNKQDtYSUo5LTUuKC83JTE3KC4qMiAmT0hEPj0rMCs0NygtLycsIClASFNOQ0pAO1hUQ0k+OTQmLDAmKzArMSMtMjEtNTEtMyQ9Rg==2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version3⤵PID:2156
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version3⤵PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
764KB
MD5c025e4eceb505d47266b354bb68021ae
SHA195bab1740d3e5033e849f3daa20088e7200ff08c
SHA25648f1da840c627aac3d66922975755ed96e01295b707b6306cf666c957fc97456
SHA51222145308ed6b9980cbff1b83bac269767b67e677538b9cdffcb5f27492306c17e1423a8ef6c906ea9ba68ac090e61fe080d363f5c75b001f0bf28c60a27c9e07
-
Filesize
125KB
MD5bd4a88ce594510d5c100c00dd75dceb0
SHA12e09b83ac1c806a37bca5fe79a972886910a3e80
SHA256d32f5eb2d1a70638ed995eeb4f626f3ebb71e43127b9539c778ad594d0d2b29c
SHA5120bfe7fbd6fc84202048b4bd92b8323edee6a712a256f2d26a3041ac5e64ec90de32692800151cdb7e590f3b286c893374fb8bf023c3123a7c2a4ebc8dfff2033
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5