Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe
-
Size
57KB
-
MD5
0fe412db1398fa7d1b50c67cdb4d8eea
-
SHA1
fdb84ba81a006508402122936cf52615c75ff530
-
SHA256
7640107035c8a1f3a35c345b65ce53285c40fd0f58a805c519d86213dda95c0c
-
SHA512
95a2d670a095a30c8138c0832317e68876b9e528b5c17c84d2d69c445d9b8cf34e4ed33d1bbae53c8b356da4f1712a4c2a6f120c44ad28ef14f382e8f3476456
-
SSDEEP
768:zzYBnD4l7t40LShbLeanhQzwy1Z1mT7wQao/dlbr4ZEtnfqANj74BDIlDiy9CEfd:XiS70hby+h2tOwFobECfT74GvY3tg
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41072-b2b1-21c1-b5c1-0305f4155515} 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41072-b2b1-21c1-b5c1-0305f4155515}\StubPath = "C:\\Windows\\system32\\iexplore.exe" 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2856 iexplore.exe -
Loads dropped DLL 2 IoCs
pid Process 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\StartKey = "C:\\Windows\\system32\\iexplore.exe" 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iexplore.exe 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe File created C:\Windows\SysWOW64\iexplore.exe 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1180 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 21 PID 2072 wrote to memory of 1180 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 21 PID 2072 wrote to memory of 1180 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 21 PID 2072 wrote to memory of 1180 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 21 PID 2072 wrote to memory of 2856 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 28 PID 2072 wrote to memory of 2856 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 28 PID 2072 wrote to memory of 2856 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 28 PID 2072 wrote to memory of 2856 2072 0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe 28
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\iexplore.exe"C:\Windows\system32\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\0fe412db1398fa7d1b50c67cdb4d8eea_JaffaCakes118.exe"3⤵
- Executes dropped EXE
PID:2856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD50fe412db1398fa7d1b50c67cdb4d8eea
SHA1fdb84ba81a006508402122936cf52615c75ff530
SHA2567640107035c8a1f3a35c345b65ce53285c40fd0f58a805c519d86213dda95c0c
SHA51295a2d670a095a30c8138c0832317e68876b9e528b5c17c84d2d69c445d9b8cf34e4ed33d1bbae53c8b356da4f1712a4c2a6f120c44ad28ef14f382e8f3476456