Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 20:24
Behavioral task
behavioral1
Sample
0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe
Resource
win7-20240611-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe
Resource
win10v2004-20240508-en
0 signatures
150 seconds
General
-
Target
0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe
-
Size
124KB
-
MD5
0aad90a03b9760b79b2c0e55bb88d805
-
SHA1
06126dbbd0b40fb955810f3ae8c55d65cd953617
-
SHA256
73e495b7e10e3e776fcfee1cd820d39770841354327886d8a81d391523baa46c
-
SHA512
0bdfd7db378d8022ca6a3cbb54eab071431b778371bbf465c4f89df5bf78bbbc8b36ceddc7735d2e15f33d6f0b05174a13ae9c4ee6b17dc460b5de336670dd60
-
SSDEEP
1536:Jk2Ip82LQI74wq9FV695vQzc1vDf1AevO0/VI6wU8KDXuM05:noMpt6jQzCvj1AeN/VI6wtL5
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2408-0-0x0000000000400000-0x0000000000420000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\:\WINDOWS\Temp\svchast.exe 2024624202439.exe = "C:\\WINDOWS\\Temp\\svchast.exe 2024624202439.exe" 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe -
Kills process with taskkill 2 IoCs
pid Process 2420 taskkill.exe 2948 taskkill.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2948 taskkill.exe Token: SeDebugPrivilege 2420 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2420 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 28 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2408 wrote to memory of 2060 2408 0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31 PID 2060 wrote to memory of 2948 2060 svchast.exe 2024624202439.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0aad90a03b9760b79b2c0e55bb88d805_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\WINDOWS\Temp\svchast.exe 2024624202439.exe"C:\WINDOWS\Temp\svchast.exe 2024624202439.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-