Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 07:41
Static task
static1
Behavioral task
behavioral1
Sample
4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe
-
Size
511KB
-
MD5
4526076db065d5a4bc349451da0c493f
-
SHA1
03c4c1908e2897d198a2d9b5b02a6e6908e9efc3
-
SHA256
9c5265f71fee578ab7d9b8117dac2c4dc66ade21bf4d978ba5401dc12703f27d
-
SHA512
62fd1bc288945a9c29a7fd8df53c6afb4a2875e6b6fcdd4bd2697cc1461f65f2d193ec21a99e1afaecba2a3a4fc3b6140b66bf256ca90fdf1bc366dab8f8c169
-
SSDEEP
12288:Q1MbIpRtJTI6Kl8jBt1RMYn0IXQhQaCb/tDz1FcH6w:Q1MbuJTLjBt/fjkLCrd1iaw
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2088 s1766.exe -
Loads dropped DLL 4 IoCs
pid Process 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 2088 s1766.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2088 s1766.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2088 s1766.exe 2088 s1766.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2088 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 28 PID 2224 wrote to memory of 2088 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 28 PID 2224 wrote to memory of 2088 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 28 PID 2224 wrote to memory of 2088 2224 4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\n1766\s1766.exe"C:\Users\Admin\AppData\Local\Temp\n1766\s1766.exe" ins.exe /e 12912908 /t 54146cb8561ca3c70a8b459d /h 13a9a3.api.socdn.com /u 76873fd7-d775-11e3-8a58-80c16e6f498c /v "C:\Users\Admin\AppData\Local\Temp\4526076db065d5a4bc349451da0c493f_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5292e5b0c53667812a05ff25415e0b91b
SHA135e0bd0943c7b449911592a0b6812642e3011c77
SHA2568ae142e7f6df8ee05c81d0317b284a747a19ae4e0a492208b04a3d25968ae574
SHA5121d984e94b25c4c51cff98a2e63795bce465e8ca526d9e391b09d12d148745b8011a22d21760bc12cf79f83adca34f22775d2e53e45311c25d4bd8d92bdfb2bd3