Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
073808fdeeb767934a357653980222eb_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
073808fdeeb767934a357653980222eb_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
073808fdeeb767934a357653980222eb_JaffaCakes118.exe
-
Size
26KB
-
MD5
073808fdeeb767934a357653980222eb
-
SHA1
56ae145739905c20048d31c68278f417d63c7d0b
-
SHA256
aa27e324e3e9404d7e356d9ff56c757325bf2434c73c4b43ce9bc2088117d505
-
SHA512
cff9ad969a2448a033cc2b1644a844439c946b6d2ea7bd0ed4dc362d0f756a4e99b07ee739801d6c4e562224f5112b75076eb637092ca101bd944bc3d6d484a6
-
SSDEEP
384:wU4wXvA/f6OQk3vaDyDMTpIDvxyP/uLtmxePRC:D7CupuMuLMx7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2564 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2876 löä#.exe -
Loads dropped DLL 5 IoCs
pid Process 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2252 2876 WerFault.exe 28 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2876 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2876 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2876 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2876 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 28 PID 2876 wrote to memory of 2252 2876 löä#.exe 29 PID 2876 wrote to memory of 2252 2876 löä#.exe 29 PID 2876 wrote to memory of 2252 2876 löä#.exe 29 PID 2876 wrote to memory of 2252 2876 löä#.exe 29 PID 2188 wrote to memory of 2564 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2564 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2564 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2564 2188 073808fdeeb767934a357653980222eb_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\073808fdeeb767934a357653980222eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\073808fdeeb767934a357653980222eb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\löä#.exe"C:\Users\Admin\AppData\Local\Temp\löä#.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 363⤵
- Loads dropped DLL
- Program crash
PID:2252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c Melt.bat2⤵
- Deletes itself
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195B
MD50be1ad3a7e637a55f591b489a3b66d1b
SHA1aa88937430ada96672275da41deb196719d59c10
SHA25611c0ccb8ef63da2fcd2eb521a00e3b500f0cd515fb258c2058a49413da698ab8
SHA512d7a62d9f44c1be51ebdcc1f9909da8ad40c51d747d86d1a424f274aa104678a66746b97e89c2195008b00c4f7fe3f570112874fc2a979e0ee4dfe794e1a45b66
-
Filesize
10KB
MD520960b3e0d1514a7120fcc93233b1c87
SHA1558ac4062339c0c5521329da2f99693854bc42c5
SHA256477b685c207c62a2a7dcee62bd5fe0eb862460e300463b800bdb972e2c1354da
SHA5121021b23a275bca10f84ae50bb8a0b22341919918ce06deb77274a96c38923edcc92d597134508e74a0d8634b64a3fa3dfbda56ab7edba6a5afe862e5097c8890