Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe
-
Size
76KB
-
MD5
14027e0ce5802da4aee2de0b0c6bc5c5
-
SHA1
6e019b42832f1553b65f663f2f11d54cf9d29b8c
-
SHA256
da456185d5879d75d08c149b51b5b1c7a4efea4cccf54c45643f34a1db6d0a1b
-
SHA512
3eaeb94b4b9c27128ca135eeb0c101576c5e25b9a2a1b3a1564fabfe9be8d891081fe5136a9d78e4c1e301b15ce339237653b7fb1b4ecfbb60dd40c32d30ef34
-
SSDEEP
768:PT5rXSibDwmKK57jI0MbJvuIcCBkoAWUZMKyzWYuzBHFzsP8VrYdbHiB991oIkfC:PFrCGDc7/BxqhhFtVrYVqoI0/oz
Malware Config
Signatures
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1712 cmd.exe -
Kills process with taskkill 1 IoCs
pid Process 2324 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2324 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2160 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2160 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2160 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2160 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2976 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2976 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2976 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2976 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 30 PID 1868 wrote to memory of 1712 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 31 PID 1868 wrote to memory of 1712 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 31 PID 1868 wrote to memory of 1712 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 31 PID 1868 wrote to memory of 1712 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 31 PID 1712 wrote to memory of 2912 1712 cmd.exe 32 PID 1712 wrote to memory of 2912 1712 cmd.exe 32 PID 1712 wrote to memory of 2912 1712 cmd.exe 32 PID 1712 wrote to memory of 2912 1712 cmd.exe 32 PID 1868 wrote to memory of 2780 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 33 PID 1868 wrote to memory of 2780 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 33 PID 1868 wrote to memory of 2780 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 33 PID 1868 wrote to memory of 2780 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 33 PID 1868 wrote to memory of 2584 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 34 PID 1868 wrote to memory of 2584 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 34 PID 1868 wrote to memory of 2584 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 34 PID 1868 wrote to memory of 2584 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 34 PID 1868 wrote to memory of 2692 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 35 PID 1868 wrote to memory of 2692 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 35 PID 1868 wrote to memory of 2692 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 35 PID 1868 wrote to memory of 2692 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 35 PID 1868 wrote to memory of 2708 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 36 PID 1868 wrote to memory of 2708 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 36 PID 1868 wrote to memory of 2708 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 36 PID 1868 wrote to memory of 2708 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 36 PID 1868 wrote to memory of 2848 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 37 PID 1868 wrote to memory of 2848 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 37 PID 1868 wrote to memory of 2848 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 37 PID 1868 wrote to memory of 2848 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 37 PID 1868 wrote to memory of 2636 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 38 PID 1868 wrote to memory of 2636 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 38 PID 1868 wrote to memory of 2636 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 38 PID 1868 wrote to memory of 2636 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 38 PID 1868 wrote to memory of 2616 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 39 PID 1868 wrote to memory of 2616 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 39 PID 1868 wrote to memory of 2616 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 39 PID 1868 wrote to memory of 2616 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 39 PID 1868 wrote to memory of 2744 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 40 PID 1868 wrote to memory of 2744 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 40 PID 1868 wrote to memory of 2744 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 40 PID 1868 wrote to memory of 2744 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 40 PID 1868 wrote to memory of 2776 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 41 PID 1868 wrote to memory of 2776 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 41 PID 1868 wrote to memory of 2776 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 41 PID 1868 wrote to memory of 2776 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 41 PID 2776 wrote to memory of 2324 2776 cmd.exe 42 PID 2776 wrote to memory of 2324 2776 cmd.exe 42 PID 2776 wrote to memory of 2324 2776 cmd.exe 42 PID 2776 wrote to memory of 2324 2776 cmd.exe 42 PID 1868 wrote to memory of 2604 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 44 PID 1868 wrote to memory of 2604 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 44 PID 1868 wrote to memory of 2604 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 44 PID 1868 wrote to memory of 2604 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 44 PID 1868 wrote to memory of 2492 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 45 PID 1868 wrote to memory of 2492 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 45 PID 1868 wrote to memory of 2492 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 45 PID 1868 wrote to memory of 2492 1868 14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe 45 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2912 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14027e0ce5802da4aee2de0b0c6bc5c5_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"2⤵PID:2160
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ztmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ztmp"2⤵PID:2976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ztmp2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\ztmp3⤵
- Views/modifies file attributes
PID:2912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp40979.bat" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp40979.bat"2⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp65849.exe" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp65849.exe"2⤵PID:2744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ztmp\tmp40979.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp40979.bat" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp40979.bat"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp65849.exe" del "C:\Users\Admin\AppData\Local\Temp\ztmp\tmp65849.exe"2⤵PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270B
MD5af4c5148313412b65d3f3bc11152a61e
SHA1168576b06e3d00655755366f66a0d1173b9eb806
SHA2560c91e4ffba38ed02fb5a2ef3bd47a2f1faeaa2e07c007741cdc71311e8dbfeb7
SHA512942a3df52e8b315a9e1a34c7c681eb36934465ae1281b6575cca334a0152dc5ccf8c0d5e8b3e8fc23c24ebabeed447d5686e627af88cce600d594c0feb2e243b
-
Filesize
15B
MD53c52638971ead82b5929d605c1314ee0
SHA17318148a40faca203ac402dff51bbb04e638545c
SHA2565614459ec05fdf6110fa8ce54c34e859671eeffba2b7bb4b1ad6c2c6706855ab
SHA51246f85f730e3ca9a57f51416c6ab4d03f868f895568eee8f7943cd249b2f71d2a3e83c34e7132715c983d3efaa865a9cb599a4278c911130a0a6948a535c0573b