Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe
-
Size
271KB
-
MD5
0e8623af5c2a207bb64f8b73281dfc58
-
SHA1
bf95b139f0c71886c37458f23de262f113f53d07
-
SHA256
d6944484a7c809917dcde9961241f91c302d844ecdf939912004ffcb4c29c5fc
-
SHA512
1c9adbd4f9093abb65b77b8e4ba63118183b82319375431a386d50ac4b59ccd7068f14d793f2b9bc404182670e323ed800da0a2fc3185520eefaf2b4d3c079d0
-
SSDEEP
6144:sguJ1x2TCiqsue1D/xyV/JjVCsP+k7DuntNMn:UJ1x2TCiq1e1D/xyV/lfX6tNM
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2352 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2516 stusmb.exe -
Loads dropped DLL 4 IoCs
pid Process 2352 cmd.exe 2352 cmd.exe 2516 stusmb.exe 2516 stusmb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2684 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 624 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2516 stusmb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2684 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2516 stusmb.exe 2516 stusmb.exe 2516 stusmb.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2516 stusmb.exe 2516 stusmb.exe 2516 stusmb.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2352 1968 0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe 28 PID 1968 wrote to memory of 2352 1968 0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe 28 PID 1968 wrote to memory of 2352 1968 0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe 28 PID 1968 wrote to memory of 2352 1968 0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe 28 PID 2352 wrote to memory of 2684 2352 cmd.exe 30 PID 2352 wrote to memory of 2684 2352 cmd.exe 30 PID 2352 wrote to memory of 2684 2352 cmd.exe 30 PID 2352 wrote to memory of 2684 2352 cmd.exe 30 PID 2352 wrote to memory of 624 2352 cmd.exe 32 PID 2352 wrote to memory of 624 2352 cmd.exe 32 PID 2352 wrote to memory of 624 2352 cmd.exe 32 PID 2352 wrote to memory of 624 2352 cmd.exe 32 PID 2352 wrote to memory of 2516 2352 cmd.exe 33 PID 2352 wrote to memory of 2516 2352 cmd.exe 33 PID 2352 wrote to memory of 2516 2352 cmd.exe 33 PID 2352 wrote to memory of 2516 2352 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1968 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\0e8623af5c2a207bb64f8b73281dfc58_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\stusmb.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 19683⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:624
-
-
C:\Users\Admin\AppData\Local\stusmb.exeC:\Users\Admin\AppData\Local\stusmb.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2516
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD50e8623af5c2a207bb64f8b73281dfc58
SHA1bf95b139f0c71886c37458f23de262f113f53d07
SHA256d6944484a7c809917dcde9961241f91c302d844ecdf939912004ffcb4c29c5fc
SHA5121c9adbd4f9093abb65b77b8e4ba63118183b82319375431a386d50ac4b59ccd7068f14d793f2b9bc404182670e323ed800da0a2fc3185520eefaf2b4d3c079d0