Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 04:51
Static task
static1
Behavioral task
behavioral1
Sample
02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe
-
Size
148KB
-
MD5
02f1adf78225d68fda17b11920a68c0a
-
SHA1
2917deaf26fef106460fee14f7e1678ae3856fde
-
SHA256
203861e33e8933c4f8c590715a0c6d909becd1a1a1ee38106648c8edfd154e69
-
SHA512
66d0ab5592f8c62a4dec6d54b231ca43182c2a0e2f90ebae45ae0729a54956d000e77ff3f01c2e90d87e4dae25e576bae0656d34d74377a94c3e82b8f688b809
-
SSDEEP
3072:6rdcqkEDx0mYh5uw7Iw8Vh4yxn/26BAx00lUrRdU:QcqxCZhc0I7NnOf09RdU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2332 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1316 iukyiin.exe -
Loads dropped DLL 4 IoCs
pid Process 2332 cmd.exe 2332 cmd.exe 1316 iukyiin.exe 1316 iukyiin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2700 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1256 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1316 iukyiin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2700 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1316 iukyiin.exe 1316 iukyiin.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1316 iukyiin.exe 1316 iukyiin.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2332 2172 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2332 2172 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2332 2172 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2332 2172 02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe 28 PID 2332 wrote to memory of 2700 2332 cmd.exe 30 PID 2332 wrote to memory of 2700 2332 cmd.exe 30 PID 2332 wrote to memory of 2700 2332 cmd.exe 30 PID 2332 wrote to memory of 2700 2332 cmd.exe 30 PID 2332 wrote to memory of 1256 2332 cmd.exe 32 PID 2332 wrote to memory of 1256 2332 cmd.exe 32 PID 2332 wrote to memory of 1256 2332 cmd.exe 32 PID 2332 wrote to memory of 1256 2332 cmd.exe 32 PID 2332 wrote to memory of 1316 2332 cmd.exe 33 PID 2332 wrote to memory of 1316 2332 cmd.exe 33 PID 2332 wrote to memory of 1316 2332 cmd.exe 33 PID 2332 wrote to memory of 1316 2332 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2172 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\02f1adf78225d68fda17b11920a68c0a_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\iukyiin.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 21723⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:1256
-
-
C:\Users\Admin\AppData\Local\iukyiin.exeC:\Users\Admin\AppData\Local\iukyiin.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1316
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD502f1adf78225d68fda17b11920a68c0a
SHA12917deaf26fef106460fee14f7e1678ae3856fde
SHA256203861e33e8933c4f8c590715a0c6d909becd1a1a1ee38106648c8edfd154e69
SHA51266d0ab5592f8c62a4dec6d54b231ca43182c2a0e2f90ebae45ae0729a54956d000e77ff3f01c2e90d87e4dae25e576bae0656d34d74377a94c3e82b8f688b809