Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe
-
Size
731KB
-
MD5
07441a4524fdb4783345a10fcf62a95b
-
SHA1
0cad2e6d515bac257ca54e080e454732479afae5
-
SHA256
756e44864f5da691dcede1fc13d1cc413199257d03f9e432c79e115aef9092e7
-
SHA512
48e233404661a73775059fd0c6b628395c6ff205cf230c57de05180f46d8df82dcfffc4fa721544bc4f24c800d7ec15e98e05273a9704478fad688f96bc1d560
-
SSDEEP
12288:Jaingtd/9iCpVEZxzraxdUdpmqFmjnDgGeIttwoPR5pWZhAIRXHYnrmt:JaigD/ArravUdsqwnlFttwYQRXHYrmt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2140 netsh.exe 2740 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2108 wrote to memory of 820 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 28 PID 2108 wrote to memory of 820 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 28 PID 2108 wrote to memory of 820 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 28 PID 2108 wrote to memory of 820 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 28 PID 2108 wrote to memory of 1764 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 30 PID 2108 wrote to memory of 1764 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 30 PID 2108 wrote to memory of 1764 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 30 PID 2108 wrote to memory of 1764 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 30 PID 2108 wrote to memory of 2248 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 32 PID 2108 wrote to memory of 2248 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 32 PID 2108 wrote to memory of 2248 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 32 PID 2108 wrote to memory of 2248 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 32 PID 2248 wrote to memory of 2140 2248 cmd.exe 34 PID 2248 wrote to memory of 2140 2248 cmd.exe 34 PID 2248 wrote to memory of 2140 2248 cmd.exe 34 PID 2248 wrote to memory of 2140 2248 cmd.exe 34 PID 2108 wrote to memory of 2704 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 35 PID 2108 wrote to memory of 2704 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 35 PID 2108 wrote to memory of 2704 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 35 PID 2108 wrote to memory of 2704 2108 07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe 35 PID 2704 wrote to memory of 2740 2704 cmd.exe 37 PID 2704 wrote to memory of 2740 2704 cmd.exe 37 PID 2704 wrote to memory of 2740 2704 cmd.exe 37 PID 2704 wrote to memory of 2740 2704 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:820
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:1764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2740
-
-