Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
beejahcbcc.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
beejahcbcc.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe
-
Size
339KB
-
MD5
614c5c5404762a729051e0b65d7decfe
-
SHA1
4621789c9fee7f3d22147733119a34d60be6c758
-
SHA256
6171ea4e35fbd54a7829b95ae3213f10c112d561aa1d8b711238305c0b1c83f5
-
SHA512
8a8fed895c93969f228f9c6741f12a8a905b5d447dab846db34fcd2ca6bce3800fa7973e98e4a6191a71e4923695de61d2481440d52b1949e913511cb05fc4b8
-
SSDEEP
3072:oY4FizYxCDRXJOwIhXClCiRDDcwh0/0xVKlAZz9q01hPfWbXvSpd6bsfI8g6dAmk:oFJ0tP11wwddpYB78nd0pEh3qZwZWdoi
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1244 beejahcbcc.exe -
Loads dropped DLL 5 IoCs
pid Process 1284 614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2440 1244 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2180 wmic.exe Token: SeSecurityPrivilege 2180 wmic.exe Token: SeTakeOwnershipPrivilege 2180 wmic.exe Token: SeLoadDriverPrivilege 2180 wmic.exe Token: SeSystemProfilePrivilege 2180 wmic.exe Token: SeSystemtimePrivilege 2180 wmic.exe Token: SeProfSingleProcessPrivilege 2180 wmic.exe Token: SeIncBasePriorityPrivilege 2180 wmic.exe Token: SeCreatePagefilePrivilege 2180 wmic.exe Token: SeBackupPrivilege 2180 wmic.exe Token: SeRestorePrivilege 2180 wmic.exe Token: SeShutdownPrivilege 2180 wmic.exe Token: SeDebugPrivilege 2180 wmic.exe Token: SeSystemEnvironmentPrivilege 2180 wmic.exe Token: SeRemoteShutdownPrivilege 2180 wmic.exe Token: SeUndockPrivilege 2180 wmic.exe Token: SeManageVolumePrivilege 2180 wmic.exe Token: 33 2180 wmic.exe Token: 34 2180 wmic.exe Token: 35 2180 wmic.exe Token: SeIncreaseQuotaPrivilege 2180 wmic.exe Token: SeSecurityPrivilege 2180 wmic.exe Token: SeTakeOwnershipPrivilege 2180 wmic.exe Token: SeLoadDriverPrivilege 2180 wmic.exe Token: SeSystemProfilePrivilege 2180 wmic.exe Token: SeSystemtimePrivilege 2180 wmic.exe Token: SeProfSingleProcessPrivilege 2180 wmic.exe Token: SeIncBasePriorityPrivilege 2180 wmic.exe Token: SeCreatePagefilePrivilege 2180 wmic.exe Token: SeBackupPrivilege 2180 wmic.exe Token: SeRestorePrivilege 2180 wmic.exe Token: SeShutdownPrivilege 2180 wmic.exe Token: SeDebugPrivilege 2180 wmic.exe Token: SeSystemEnvironmentPrivilege 2180 wmic.exe Token: SeRemoteShutdownPrivilege 2180 wmic.exe Token: SeUndockPrivilege 2180 wmic.exe Token: SeManageVolumePrivilege 2180 wmic.exe Token: 33 2180 wmic.exe Token: 34 2180 wmic.exe Token: 35 2180 wmic.exe Token: SeIncreaseQuotaPrivilege 2748 wmic.exe Token: SeSecurityPrivilege 2748 wmic.exe Token: SeTakeOwnershipPrivilege 2748 wmic.exe Token: SeLoadDriverPrivilege 2748 wmic.exe Token: SeSystemProfilePrivilege 2748 wmic.exe Token: SeSystemtimePrivilege 2748 wmic.exe Token: SeProfSingleProcessPrivilege 2748 wmic.exe Token: SeIncBasePriorityPrivilege 2748 wmic.exe Token: SeCreatePagefilePrivilege 2748 wmic.exe Token: SeBackupPrivilege 2748 wmic.exe Token: SeRestorePrivilege 2748 wmic.exe Token: SeShutdownPrivilege 2748 wmic.exe Token: SeDebugPrivilege 2748 wmic.exe Token: SeSystemEnvironmentPrivilege 2748 wmic.exe Token: SeRemoteShutdownPrivilege 2748 wmic.exe Token: SeUndockPrivilege 2748 wmic.exe Token: SeManageVolumePrivilege 2748 wmic.exe Token: 33 2748 wmic.exe Token: 34 2748 wmic.exe Token: 35 2748 wmic.exe Token: SeIncreaseQuotaPrivilege 2632 wmic.exe Token: SeSecurityPrivilege 2632 wmic.exe Token: SeTakeOwnershipPrivilege 2632 wmic.exe Token: SeLoadDriverPrivilege 2632 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1244 1284 614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe 28 PID 1284 wrote to memory of 1244 1284 614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe 28 PID 1284 wrote to memory of 1244 1284 614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe 28 PID 1284 wrote to memory of 1244 1284 614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe 28 PID 1244 wrote to memory of 2180 1244 beejahcbcc.exe 29 PID 1244 wrote to memory of 2180 1244 beejahcbcc.exe 29 PID 1244 wrote to memory of 2180 1244 beejahcbcc.exe 29 PID 1244 wrote to memory of 2180 1244 beejahcbcc.exe 29 PID 1244 wrote to memory of 2748 1244 beejahcbcc.exe 32 PID 1244 wrote to memory of 2748 1244 beejahcbcc.exe 32 PID 1244 wrote to memory of 2748 1244 beejahcbcc.exe 32 PID 1244 wrote to memory of 2748 1244 beejahcbcc.exe 32 PID 1244 wrote to memory of 2632 1244 beejahcbcc.exe 34 PID 1244 wrote to memory of 2632 1244 beejahcbcc.exe 34 PID 1244 wrote to memory of 2632 1244 beejahcbcc.exe 34 PID 1244 wrote to memory of 2632 1244 beejahcbcc.exe 34 PID 1244 wrote to memory of 2720 1244 beejahcbcc.exe 36 PID 1244 wrote to memory of 2720 1244 beejahcbcc.exe 36 PID 1244 wrote to memory of 2720 1244 beejahcbcc.exe 36 PID 1244 wrote to memory of 2720 1244 beejahcbcc.exe 36 PID 1244 wrote to memory of 2880 1244 beejahcbcc.exe 38 PID 1244 wrote to memory of 2880 1244 beejahcbcc.exe 38 PID 1244 wrote to memory of 2880 1244 beejahcbcc.exe 38 PID 1244 wrote to memory of 2880 1244 beejahcbcc.exe 38 PID 1244 wrote to memory of 2440 1244 beejahcbcc.exe 40 PID 1244 wrote to memory of 2440 1244 beejahcbcc.exe 40 PID 1244 wrote to memory of 2440 1244 beejahcbcc.exe 40 PID 1244 wrote to memory of 2440 1244 beejahcbcc.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\614c5c5404762a729051e0b65d7decfe_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\beejahcbcc.exeC:\Users\Admin\AppData\Local\Temp\beejahcbcc.exe 2|8|6|1|7|1|2|0|7|3|6 LUhDQzYvHi9MUjxOQT48KR8tTj5RUU1KRUg9PC4gKEFDUUxDQzYvHi88Rj47KBouSVFNRE5ATl1BPjwpHy1TPk9QQ0pZVEtLO2htcWo4Jylya3UsRD5QRStMSU8mQE5QJ0ZIREcaLjxLR0NERj47GClDKjwrMRksPjA1JzAZLkIzNiorHic+MzYsLyAoQS87JSsfKE9QTz1SPVJXSlFCVT9DUjoaLUhMTj1UQVRYQk9KOTcfKE9QTz1SPVJXSEBGRDsgKEJSQ1dPUUU8Hi8+VT9dO0dDRUhMRTYdKUZHTVNYQVBPUFA/UDUvHyhTRkFHSFNNTVlUS0s7IChTRzsqGi49Ui89GSxMU0ZOSEZEXVc+ST1NRT9IRkBFRU5PRjsYKUhMXlBVR1FDSz03c2t0YyAoTz9STUxNQk1FX05QP1BXPkBSUjsyGSxCRzw/VzYwHi9CUFlCUUhARkhBXz5LPVBRSlM+QztmWmltYxgpQ0hWTExIPj5dQUo8Ky82LiouKiwxLS0qMTAgKE07UDlGSz5LXUlHUE4/REY8bXFzZRksTkdFPzwqMzI5KTUqNiksHyhDTVdHSUk/PFlTQkxDPSovKTAnLC8qNCg2My8wOC0sKUlM2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716247799.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716247799.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716247799.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716247799.txt bios get version3⤵PID:2720
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716247799.txt bios get version3⤵PID:2880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
538KB
MD57505644b29d641ccaf743ae6ae560af7
SHA1cb13b14e14f8dfd0889a75223e7a0be01b76ce2d
SHA25610cabb3824a887ffaf6d07a342cd846dd59f4fa721c8f3191736f18b4c9b40f8
SHA512ff848e719de08b0f067c49416b28ddd2fd7f97add4a1ffecce7b3da8bd37641ef2f24753173704857c1accd843caa8f1bd7c73086ccedc385d324319f835e019