Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe
-
Size
27KB
-
MD5
0330a15dc895ef977be5e9540cece8d9
-
SHA1
63ad7696a8ca1c1d9bf65e7bdcb8a1f84d972c10
-
SHA256
9482dba8abbf6cee16dee446a7be06a4e0c353d3d4b8d420692b270c3b333441
-
SHA512
033872833b6a099dca5438906550d179836befaa2c20f6ae5ddf2e543370d0a8423ec8b987318d7cd9549c0a242c92650dc2b49a50055fa9b06b3b042e8d0402
-
SSDEEP
384:Ceeocl/9ziw8MKqxPjK82pI+KjF+428N44h8lJIReycKeQYDYuVgs:CxBl/9zv8MKqV2z0ja4+leRenKTbuVg
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HFDF = "C:\\Windows\\system32\\hfdf0703.exe" 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\hfdf0703.dll 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe File created C:\Windows\SysWOW64\test.sys 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2180 2468 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2468 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1248 2468 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe 21 PID 2468 wrote to memory of 2180 2468 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe 28 PID 2468 wrote to memory of 2180 2468 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe 28 PID 2468 wrote to memory of 2180 2468 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe 28 PID 2468 wrote to memory of 2180 2468 0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe 28
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0330a15dc895ef977be5e9540cece8d9_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2523⤵
- Program crash
PID:2180
-
-