Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/downloadmr.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/downloadmr.exe
Resource
win10v2004-20240508-en
General
-
Target
15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe
-
Size
142KB
-
MD5
15a4b50715f20a7c99be05688a05f8c3
-
SHA1
ca1fdfbf306e8573cb1c16a5e41fa507e101d5a6
-
SHA256
23e89d5082fb7107ef93dedd7969d1f27cfa7c04ca64107be308e2d722a756fa
-
SHA512
1b5546f8fee0d21523dcb04cf5756be560d27fcdabf201f68628a4ef0a56b8f413df6c9c7efe2ecff340154eb62314a51c68d48ee4eacbab47c46cfff1b70b43
-
SSDEEP
3072:CnOn7t7XpdpCCTg/sxFgJKeqgKJ+BCWC3bGfToKZdsEacVdANXL3XPrW:CKpdcCrTdgKj3+ToKsHcVdAN73XK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2288 downloadmr.exe -
Loads dropped DLL 4 IoCs
pid Process 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2288 downloadmr.exe 2288 downloadmr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2288 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 28 PID 2068 wrote to memory of 2288 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 28 PID 2068 wrote to memory of 2288 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 28 PID 2068 wrote to memory of 2288 2068 15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15a4b50715f20a7c99be05688a05f8c3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\nso1DC0.tmp\downloadmr.exeC:\Users\Admin\AppData\Local\Temp\nso1DC0.tmp\downloadmr.exe /u4eb7a918-1108-4455-aeea-4ae85bc06f2f /e20935692⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD55ebc73650256e9c8ddbcda231db829a1
SHA1988d4535e18754ab2a6248abae96c5697d7dbcd5
SHA2561eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493
SHA512b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270
-
Filesize
122KB
MD5da254a8488b60244654e1cf4d6796cf8
SHA123d06f4589786652a3a226b5012a5520a3d03452
SHA2566d3b82a7ad74a1e88ae4d0f9176082130f1558fb3ff42a8b45ca8b80445efc2d
SHA512d311f90ad65441f6c7ae55220c2c3f117aa7601d083e6847e1b58b96c3c332d68a25d445310818396dc88678fb9ec5356f35a04a392c3d23746a2231e14b0a2e