Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
6081277b1c6a1fcb478cd938298bd327
-
SHA1
2581861ef703055895db434dfcab89746102ff7e
-
SHA256
b57e589ef7ee2da883663527878128aa0c1909d0ba7a9bca91f10f04e91a47fb
-
SHA512
7bf6299df2d0f6eed284c8959d582fa0ecaaea66fe403b78eebb5c077de95a262d40683b1129804cf55edf422dc01d199c65855aa273d5974ec8da174c599ba5
-
SSDEEP
12288:MandmtR21mT1TUylJDvc8aYm59SDV5Sor8gZWkXaXyo+5DCG4OQRQNxHb4KDqapV:MW1uGy+SRQorc5ihDCIAK9/ICH
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk name.exe -
Executes dropped EXE 2 IoCs
pid Process 2420 name.exe 2424 name.exe -
Loads dropped DLL 1 IoCs
pid Process 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1640 set thread context of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 2420 set thread context of 2424 2420 name.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 2420 name.exe 2420 name.exe 2420 name.exe 2420 name.exe 2420 name.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe Token: SeDebugPrivilege 2420 name.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2516 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2924 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 28 PID 1640 wrote to memory of 2924 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 28 PID 1640 wrote to memory of 2924 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 28 PID 1640 wrote to memory of 2924 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 28 PID 2924 wrote to memory of 2872 2924 cmd.exe 30 PID 2924 wrote to memory of 2872 2924 cmd.exe 30 PID 2924 wrote to memory of 2872 2924 cmd.exe 30 PID 2924 wrote to memory of 2872 2924 cmd.exe 30 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2516 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 31 PID 1640 wrote to memory of 2420 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 32 PID 1640 wrote to memory of 2420 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 32 PID 1640 wrote to memory of 2420 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 32 PID 1640 wrote to memory of 2420 1640 6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe 32 PID 2420 wrote to memory of 1688 2420 name.exe 33 PID 2420 wrote to memory of 1688 2420 name.exe 33 PID 2420 wrote to memory of 1688 2420 name.exe 33 PID 2420 wrote to memory of 1688 2420 name.exe 33 PID 1688 wrote to memory of 632 1688 cmd.exe 35 PID 1688 wrote to memory of 632 1688 cmd.exe 35 PID 1688 wrote to memory of 632 1688 cmd.exe 35 PID 1688 wrote to memory of 632 1688 cmd.exe 35 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36 PID 2420 wrote to memory of 2424 2420 name.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk " /f3⤵PID:2872
-
-
-
C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2516
-
-
C:\Users\Admin\AppData\Roaming\FolderN\name.exeC:\Users\Admin\AppData\Roaming\FolderN\name.exe2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk " /f4⤵PID:632
-
-
-
C:\Users\Admin\AppData\Roaming\FolderN\name.exe"C:\Users\Admin\AppData\Roaming\FolderN\name.exe"3⤵
- Executes dropped EXE
PID:2424
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
832B
MD57b88f84d8ae88ccf1bbe24864ba6df4e
SHA10025eaae4115ea813213903e21e4530b564b4966
SHA256eba95e20f2e0dfbf98a3b402cc828e24aefc41385dffcb4ee50ea0b470e6a4a5
SHA512672a92a33a4196191065ef0394f0152eaf5878ca755ac2423e67ccb5269237f4a0e4ebc0dfe5d653f0a26039f997929913ef029750b2075a93ad9c7a99212e17
-
Filesize
874B
MD5a07c444c22b2656f31aebacbae854908
SHA1ae04023bf53ae87cbf8d6e5501e7f21060bcf8be
SHA256f23e89964fc4c44056f12faffd5452df0af7661abd80e60b89e33f809c76c719
SHA5128929f9dfe9e603f6b9aefd2036a5e329d13dd9dd99ad22b5a234352036e43351a8eb7fdc92065127829e41f9dce80feea2a97ecce1cb96c0e3bc78d31b0a192f
-
Filesize
85KB
MD52e5f1cf69f92392f8829fc9c9263ae9b
SHA197b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA25651985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883
-
Filesize
1.4MB
MD56081277b1c6a1fcb478cd938298bd327
SHA12581861ef703055895db434dfcab89746102ff7e
SHA256b57e589ef7ee2da883663527878128aa0c1909d0ba7a9bca91f10f04e91a47fb
SHA5127bf6299df2d0f6eed284c8959d582fa0ecaaea66fe403b78eebb5c077de95a262d40683b1129804cf55edf422dc01d199c65855aa273d5974ec8da174c599ba5