Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe
-
Size
153KB
-
MD5
0f487f62ec9125706a72d8c1bfaa9751
-
SHA1
69b673e4218d97979b0d663cb3ea4d21c8659b4d
-
SHA256
3153e5901277bcb3e8373bfe8751ab46eafc572614f6f412c80aee4ba270a2d0
-
SHA512
21599b24410979c171b912eb10383d2fd142d52776859d48494564f221e29ed59eaf689a3a9a5036afb7b4715cb9ffca964ba0762370c2bddadb828bdbe214e7
-
SSDEEP
3072:x1lK2I+cQuVWjvtjuJNvtb68fdc/yUGLdJ/9uJu7GF3sP4:zlvRY0yFb68lyGLdB9uJAM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2424 Help.exe 2540 Help.exe -
Loads dropped DLL 3 IoCs
pid Process 2664 0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe 2664 0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe 2424 Help.exe -
resource yara_rule behavioral1/files/0x000c000000015d79-6.dat upx behavioral1/memory/2424-11-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2424-21-0x0000000000400000-0x0000000000475000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2424 set thread context of 2540 2424 Help.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2540 Help.exe 2540 Help.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2424 Help.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2424 2664 0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe 28 PID 2664 wrote to memory of 2424 2664 0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe 28 PID 2664 wrote to memory of 2424 2664 0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe 28 PID 2664 wrote to memory of 2424 2664 0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe 28 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2424 wrote to memory of 2540 2424 Help.exe 29 PID 2540 wrote to memory of 1180 2540 Help.exe 21 PID 2540 wrote to memory of 1180 2540 Help.exe 21 PID 2540 wrote to memory of 1180 2540 Help.exe 21 PID 2540 wrote to memory of 1180 2540 Help.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f487f62ec9125706a72d8c1bfaa9751_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Help.exe"C:\Users\Admin\AppData\Local\Temp\Help.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Help.exe"C:\Users\Admin\AppData\Local\Temp\Help.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD557b9bbd63a0fe6b80f25818b59ae6bcf
SHA10502bb225f28c6ff0f1cab380db877fa01ef69b8
SHA2565a79354da34e33ce6c28091233b286450a4cf268e45efba74f7f1668cbd704ff
SHA512da11eae0991e073f6a52d3de75105cf1640735761d022150d773b88a00ae751021488203a5be4b20483a2d9d65e6aabdc04d1fb363340bba58c8372c995b478f