Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe
-
Size
20KB
-
MD5
0a284427977e7a810e836eca924f20ef
-
SHA1
d72f1673f41f6a95eeaab019bd240dd3f5343534
-
SHA256
12df6769361063d669c7d2b72ff7d017c357eb3e3fd8fd7fe564c9f13f5837af
-
SHA512
f1d41f66ce332b3e3a5a54a1d1a268ca9b85c78adba414097857ffa27a451a013892634535bb37ee6ab86ee55e5e3982f9de009d1ceb7f1a170d5aff9d748eb8
-
SSDEEP
384:2r+bZRipKHcbnB1B30LEZvTE6WRT7T10FpBsJO5Upl9th:lf9Hcbn+/IFpBsFplr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2752 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 csrcs.exe -
Loads dropped DLL 2 IoCs
pid Process 2752 svchost.exe 2752 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrcs.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1124 set thread context of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 2708 set thread context of 2316 2708 csrcs.exe 30 -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 1124 wrote to memory of 2752 1124 0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe 28 PID 2752 wrote to memory of 2708 2752 svchost.exe 29 PID 2752 wrote to memory of 2708 2752 svchost.exe 29 PID 2752 wrote to memory of 2708 2752 svchost.exe 29 PID 2752 wrote to memory of 2708 2752 svchost.exe 29 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30 PID 2708 wrote to memory of 2316 2708 csrcs.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a284427977e7a810e836eca924f20ef_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\csrcs.exe"C:\Users\Admin\AppData\Local\Temp\csrcs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2316
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD50a284427977e7a810e836eca924f20ef
SHA1d72f1673f41f6a95eeaab019bd240dd3f5343534
SHA25612df6769361063d669c7d2b72ff7d017c357eb3e3fd8fd7fe564c9f13f5837af
SHA512f1d41f66ce332b3e3a5a54a1d1a268ca9b85c78adba414097857ffa27a451a013892634535bb37ee6ab86ee55e5e3982f9de009d1ceb7f1a170d5aff9d748eb8