Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe
-
Size
233KB
-
MD5
804a1f003f4942d4c81c6d221ef10e8f
-
SHA1
3c91d9723ece75f2c98782739ce0fb3c6f60dbda
-
SHA256
8613cef95caf6fce398e47856b320392b5fc0e940c891a3cc512562f29361b8a
-
SHA512
3d1256063708aa91c59b730ecdcd8ad6b3270e49a8808d4d216aaca0e8cffc70e8814965de284e341e2af51d13b29b900614fdcd1de658bae5b90fcf057f5634
-
SSDEEP
6144:4xyMeM8tKmy/q7RglyFlqsGnK48uGSiU4pt6:4xyMehti/8R7lJEGSiU4C
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 840 804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 840 wrote to memory of 2584 840 804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe 28 PID 840 wrote to memory of 2584 840 804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe 28 PID 840 wrote to memory of 2584 840 804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe 28 PID 840 wrote to memory of 2584 840 804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\e9adc898-e100-48db-9c9c-ce2d4cff9ceb\start.hta2⤵
- Modifies Internet Explorer settings
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e88ebd85dd56110ac6ea93fe0922988e
SHA1684a31d864d33ff736234c41ac4e8d2c7f90d5ae
SHA256379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb
SHA512211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7
-
Filesize
1KB
MD51e0053dfeeecf4c16284d6dad4fd86f4
SHA1fe4ca30de707e1f77e5e258f62007f82633b6773
SHA256e2d32f98e234880b02f55506b75e13ec992ed53f39c35c19bef070b081eea3bb
SHA5125fb547735e5516f95ecb68bc5f862c7af963fe415a3aee9f2e4671473d1dbe36c65e2e2760900b96a81f5d27cb49b6f68c2f10d310ede93963ad78eea691e76b
-
Filesize
122KB
MD547cb6d4a317540d0fbbdbf813bd24d7f
SHA1fdf0ca931b67bda1c62c157357dfb0729b9e9ee8
SHA256d376d8192ece1fe69a9ec5a77fb512c41a3fe55417478635d7fe2d874e0ed49e
SHA5121fb63ab4d7fb8fcc26f4c9333bbfa893b1253606035df6be8bfa2188e363372999f517bf63f061fa96047c5529a4170fc55c1f67828ae87c8a47b4b2362a1f80