Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 00:02
Behavioral task
behavioral1
Sample
855d803590b82b805357587c47c583f2_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
855d803590b82b805357587c47c583f2_JaffaCakes118.exe
-
Size
52KB
-
MD5
855d803590b82b805357587c47c583f2
-
SHA1
153458b9b7965f32a43b9d1fa87f84170599bd4a
-
SHA256
fd3cae55558bda7cf4290d5e9187504ab1f34adf948801ebff7d3fcb69f9e28f
-
SHA512
d009cff99535e5a8c79b013c4f0a073689f9bcad11a89a8e8110ca8afab88af947ac6c5c23078c04d1c85ef8b586657ce1bdf307da9e6cf4a51d0b11db59b536
-
SSDEEP
768:YGEMazGKtp2fCpgQtHgRNIBgF2eXY1g8rUy138YbqbvYPZMi8FmbTdd+A:YOsppgQtHEI29o1g8z385bkZ/x+A
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000419000-memory.dmp family_gh0strat behavioral1/memory/2948-13-0x0000000000400000-0x0000000000419000-memory.dmp family_gh0strat behavioral1/memory/1972-16-0x0000000000400000-0x0000000000419000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2948 Bjobome.exe -
Loads dropped DLL 1 IoCs
pid Process 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/files/0x0033000000015f6d-4.dat upx behavioral1/memory/2948-5-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/2948-13-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1972-16-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 855d803590b82b805357587c47c583f2_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Eekyym\Bjobome.exe 855d803590b82b805357587c47c583f2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Eekyym\Bjobome.exe 855d803590b82b805357587c47c583f2_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 2948 Bjobome.exe 2948 Bjobome.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 43 IoCs
pid Process 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe 2948 Bjobome.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe Token: SeDebugPrivilege 2948 Bjobome.exe Token: SeTakeOwnershipPrivilege 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe Token: SeRestorePrivilege 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe Token: SeBackupPrivilege 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 388 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 3 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 396 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 4 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 424 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 5 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 480 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 6 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 496 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 7 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 504 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 8 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 604 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 9 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 684 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 10 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 752 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 11 PID 1972 wrote to memory of 820 1972 855d803590b82b805357587c47c583f2_JaffaCakes118.exe 12
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:388
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:396
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2120
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:752
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1100
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1052
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1060
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1136
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2800
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft Eekyym\Bjobome.exe"C:\Program Files (x86)\Microsoft Eekyym\Bjobome.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:496
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:504
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\855d803590b82b805357587c47c583f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\855d803590b82b805357587c47c583f2_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\259559263\zmstage.exeC:\Users\Admin\AppData\Local\Temp\259559263\zmstage.exe1⤵PID:1208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5855d803590b82b805357587c47c583f2
SHA1153458b9b7965f32a43b9d1fa87f84170599bd4a
SHA256fd3cae55558bda7cf4290d5e9187504ab1f34adf948801ebff7d3fcb69f9e28f
SHA512d009cff99535e5a8c79b013c4f0a073689f9bcad11a89a8e8110ca8afab88af947ac6c5c23078c04d1c85ef8b586657ce1bdf307da9e6cf4a51d0b11db59b536
-
Filesize
165KB
MD5ee97b6e581f1d25f682e1d272edf3c66
SHA1f74b4e7cfaa36c0ccb5e7943cfbc713ac917409a
SHA2565abee0c559481cb94a8285b40068c1abd71a542690799cf0c43063354bac81df
SHA5121dff8490160d856226579699d6a0f072d6cbf57e70f0b634332c8a1d27ce0f1fe76ea0967560243c9b9cef142e1cc49a6f8887a4e428489de228d965855b2b84