Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 11:49
Static task
static1
Behavioral task
behavioral1
Sample
b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/moo.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/moo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe
-
Size
574KB
-
MD5
b35a407ddffa60fe714c0696e3023933
-
SHA1
39bb4aa11f831044b35f45b3a8b5cb5548d4d23d
-
SHA256
1684c2d7efc42505f47e901f5293ecf3c181b06bad66760ca8988b7a26af697f
-
SHA512
36d626270ef1f829d0ab9b399efd884d74b6bd0d817691be1c7f2a7d442a2946d3419a215c22024f95806e0b82ff4b672ba5ce19957e43ffe9b11e37a4d9a779
-
SSDEEP
12288:lH/w0GViRQcy32a5m9FyA+vqYy0UAZLJYpYz2q+:lfwSQcy3V5m9FytCOZsA4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2140 bbjcabfedbhd.exe -
Loads dropped DLL 10 IoCs
pid Process 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 2840 WerFault.exe 2840 WerFault.exe 2840 WerFault.exe 2840 WerFault.exe 2840 WerFault.exe 2840 WerFault.exe 2840 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2840 2140 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2092 wmic.exe Token: SeSecurityPrivilege 2092 wmic.exe Token: SeTakeOwnershipPrivilege 2092 wmic.exe Token: SeLoadDriverPrivilege 2092 wmic.exe Token: SeSystemProfilePrivilege 2092 wmic.exe Token: SeSystemtimePrivilege 2092 wmic.exe Token: SeProfSingleProcessPrivilege 2092 wmic.exe Token: SeIncBasePriorityPrivilege 2092 wmic.exe Token: SeCreatePagefilePrivilege 2092 wmic.exe Token: SeBackupPrivilege 2092 wmic.exe Token: SeRestorePrivilege 2092 wmic.exe Token: SeShutdownPrivilege 2092 wmic.exe Token: SeDebugPrivilege 2092 wmic.exe Token: SeSystemEnvironmentPrivilege 2092 wmic.exe Token: SeRemoteShutdownPrivilege 2092 wmic.exe Token: SeUndockPrivilege 2092 wmic.exe Token: SeManageVolumePrivilege 2092 wmic.exe Token: 33 2092 wmic.exe Token: 34 2092 wmic.exe Token: 35 2092 wmic.exe Token: SeIncreaseQuotaPrivilege 2092 wmic.exe Token: SeSecurityPrivilege 2092 wmic.exe Token: SeTakeOwnershipPrivilege 2092 wmic.exe Token: SeLoadDriverPrivilege 2092 wmic.exe Token: SeSystemProfilePrivilege 2092 wmic.exe Token: SeSystemtimePrivilege 2092 wmic.exe Token: SeProfSingleProcessPrivilege 2092 wmic.exe Token: SeIncBasePriorityPrivilege 2092 wmic.exe Token: SeCreatePagefilePrivilege 2092 wmic.exe Token: SeBackupPrivilege 2092 wmic.exe Token: SeRestorePrivilege 2092 wmic.exe Token: SeShutdownPrivilege 2092 wmic.exe Token: SeDebugPrivilege 2092 wmic.exe Token: SeSystemEnvironmentPrivilege 2092 wmic.exe Token: SeRemoteShutdownPrivilege 2092 wmic.exe Token: SeUndockPrivilege 2092 wmic.exe Token: SeManageVolumePrivilege 2092 wmic.exe Token: 33 2092 wmic.exe Token: 34 2092 wmic.exe Token: 35 2092 wmic.exe Token: SeIncreaseQuotaPrivilege 2700 wmic.exe Token: SeSecurityPrivilege 2700 wmic.exe Token: SeTakeOwnershipPrivilege 2700 wmic.exe Token: SeLoadDriverPrivilege 2700 wmic.exe Token: SeSystemProfilePrivilege 2700 wmic.exe Token: SeSystemtimePrivilege 2700 wmic.exe Token: SeProfSingleProcessPrivilege 2700 wmic.exe Token: SeIncBasePriorityPrivilege 2700 wmic.exe Token: SeCreatePagefilePrivilege 2700 wmic.exe Token: SeBackupPrivilege 2700 wmic.exe Token: SeRestorePrivilege 2700 wmic.exe Token: SeShutdownPrivilege 2700 wmic.exe Token: SeDebugPrivilege 2700 wmic.exe Token: SeSystemEnvironmentPrivilege 2700 wmic.exe Token: SeRemoteShutdownPrivilege 2700 wmic.exe Token: SeUndockPrivilege 2700 wmic.exe Token: SeManageVolumePrivilege 2700 wmic.exe Token: 33 2700 wmic.exe Token: 34 2700 wmic.exe Token: 35 2700 wmic.exe Token: SeIncreaseQuotaPrivilege 3048 wmic.exe Token: SeSecurityPrivilege 3048 wmic.exe Token: SeTakeOwnershipPrivilege 3048 wmic.exe Token: SeLoadDriverPrivilege 3048 wmic.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2140 1688 b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe 28 PID 2140 wrote to memory of 2092 2140 bbjcabfedbhd.exe 29 PID 2140 wrote to memory of 2092 2140 bbjcabfedbhd.exe 29 PID 2140 wrote to memory of 2092 2140 bbjcabfedbhd.exe 29 PID 2140 wrote to memory of 2092 2140 bbjcabfedbhd.exe 29 PID 2140 wrote to memory of 2700 2140 bbjcabfedbhd.exe 32 PID 2140 wrote to memory of 2700 2140 bbjcabfedbhd.exe 32 PID 2140 wrote to memory of 2700 2140 bbjcabfedbhd.exe 32 PID 2140 wrote to memory of 2700 2140 bbjcabfedbhd.exe 32 PID 2140 wrote to memory of 3048 2140 bbjcabfedbhd.exe 34 PID 2140 wrote to memory of 3048 2140 bbjcabfedbhd.exe 34 PID 2140 wrote to memory of 3048 2140 bbjcabfedbhd.exe 34 PID 2140 wrote to memory of 3048 2140 bbjcabfedbhd.exe 34 PID 2140 wrote to memory of 2696 2140 bbjcabfedbhd.exe 36 PID 2140 wrote to memory of 2696 2140 bbjcabfedbhd.exe 36 PID 2140 wrote to memory of 2696 2140 bbjcabfedbhd.exe 36 PID 2140 wrote to memory of 2696 2140 bbjcabfedbhd.exe 36 PID 2140 wrote to memory of 2600 2140 bbjcabfedbhd.exe 38 PID 2140 wrote to memory of 2600 2140 bbjcabfedbhd.exe 38 PID 2140 wrote to memory of 2600 2140 bbjcabfedbhd.exe 38 PID 2140 wrote to memory of 2600 2140 bbjcabfedbhd.exe 38 PID 2140 wrote to memory of 2840 2140 bbjcabfedbhd.exe 40 PID 2140 wrote to memory of 2840 2140 bbjcabfedbhd.exe 40 PID 2140 wrote to memory of 2840 2140 bbjcabfedbhd.exe 40 PID 2140 wrote to memory of 2840 2140 bbjcabfedbhd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b35a407ddffa60fe714c0696e3023933_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\bbjcabfedbhd.exeC:\Users\Admin\AppData\Local\Temp\bbjcabfedbhd.exe 1-3-4-2-9-8-7-4-4-3-1 Lk1FQjQpMTAzMR8uUFFAR0E9OSwdLk1CUFVGSkRFQDowHyxAR0pMQkA5LzQ3LS8eJjtCQDktHy5NTk07TTxQW0ZDPC8vNykxGStPQlFVQk5dTEpFOWRxc283Ky1qXWtyKnFnZCpdbmclXV1wXi1oa2JtFyc8SEVASkhBOR4mPCo5KS4fLkEuOyQpGStAMDwsLhwtOyw2KS0dLkMyOSsoGChMTkxDVEBQXUdKQlI9QFg8HStOSUc9UT9RXkRSSD80GChMTkxDVEBQXUU5RkE5UGRzcmweJj1RQVtSUUs6HC08UD5bP0pDS0ZKQzQYKERLUFNeP05NTks+TjkvHy5RRD9FQ1JLUVxUUUk5HiZORjkuHS5DUC07KCguLiwdLlFSSlJART5bU0JLQkxJQ0BFOkNBUlFLOhwtQEtYTlFLU0hKQTtram5hHCxRRFFRUEVBR0NbUlJET1tCOFFMOS4dLkdGQENPNSocK0ZSXkFVTDhFQj9bQk1CT1VOSz09OWJea3JiHC07R1BKSExAQ1xFTjQpKzQqNDItLy80JSorNRwsU0hKQTsoLCstMjYzNDM0HiY8SFNKSU5AQVtSQEU+OS0sMDgsLi4oLSMzNi04OS80KEdF2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718538568.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718538568.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718538568.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718538568.txt bios get version3⤵PID:2696
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81718538568.txt bios get version3⤵PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
826KB
MD5cb0c60c38ae0020b7468d2265ddd4485
SHA14ddf8959199eaaa1a74605916cfad59c6d04b34c
SHA256951c8986d5d7544ed0a1b2a5e32b4b1cbe9954c5662a5947dd9f75c6e4a46f15
SHA512fc9781f5378aa5cb5d293c3e5a40617e0c2321e3b8b0a846eac21275ec4a08faf6db96e6b5ea87bb0473d6e8c1d4e55283de7469e69d635f1452c1aae675fb1f
-
Filesize
108KB
MD5076a3050150c1887d9a5ef76762ff4a4
SHA1225adac93a9de5af6ca5646cdaf66c69c821dee4
SHA25672d94ff0e7b385b21bb5f103f055602b67e3e805408d81859fe5ec93a1dc2c2b
SHA51266be5077dc0380232f5033f101447c08ae0f8c9b5768b2c3a5ecca9b33d4d3932dc4d5fe4167021736884111ef57f1839bd3525ba04968917591f71ee65ac0c8
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5