Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe
-
Size
454KB
-
MD5
adb0f8767bea7ac9d205e62186430607
-
SHA1
0348576acf0c5b280cc201c6458157ae16d41307
-
SHA256
5022d40ad46ed72094cdc31662452b47e26a4f19edcc290cff448d3546de5d41
-
SHA512
97d7b2069ee89504dd31b8cc556d7f2c87b6cce1834beaac52949c2063259d9880e2e0e228127cbe241a09e0f2b266a3c68345038b395b22c16a8c131d14cd9e
-
SSDEEP
6144:vvaqS4IR/kviXzd4N6qJFldlibYOlU/glqmOgDVL5ul94BhunZQpLzms7VFPYYK:y/kviXzdyGYr/eDVL5ul2unZatC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1388 qfjesjluewfgfyu.exe -
Loads dropped DLL 2 IoCs
pid Process 1284 adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe 1284 adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main qfjesjluewfgfyu.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1388 qfjesjluewfgfyu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1388 qfjesjluewfgfyu.exe 1388 qfjesjluewfgfyu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1388 1284 adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe 28 PID 1284 wrote to memory of 1388 1284 adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe 28 PID 1284 wrote to memory of 1388 1284 adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe 28 PID 1284 wrote to memory of 1388 1284 adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe"C:\Users\Admin\AppData\Local\Temp\\qfjesjluewfgfyu.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD5adb0f8767bea7ac9d205e62186430607
SHA10348576acf0c5b280cc201c6458157ae16d41307
SHA2565022d40ad46ed72094cdc31662452b47e26a4f19edcc290cff448d3546de5d41
SHA51297d7b2069ee89504dd31b8cc556d7f2c87b6cce1834beaac52949c2063259d9880e2e0e228127cbe241a09e0f2b266a3c68345038b395b22c16a8c131d14cd9e
-
Filesize
11KB
MD59a7e17351f0e74570b387600922e59e0
SHA1017bf40ae2cb8321ee9825e3b93339fd41a148da
SHA25644b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c
SHA512bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3