Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
-
Size
74KB
-
MD5
189851836e7c3c836a36cbd4e5d00dce
-
SHA1
e1ceb793467c8fb1442a3e3a581c4151275559dd
-
SHA256
ce46a492a3abc1faab1e4a6e3ae430b8c68b858cba204d7a86f16bba19683661
-
SHA512
b7caeb94c2a7e6cba9073ced87de0ad425dd0a212af5b2698ed8c2958b5be51596d514d875eb227fb6c9f3503a0ed916fa3926cbd4a2587ebb5eb6af911d9e89
-
SSDEEP
1536:t0JUpReIXnb72L31MPuH/i9cPdbZdDc7rqUDJxjayej6mQ9:txSI3/2Dfq9cPdIDJxGyH9
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2096 rundl32.exe 2660 rundl32.exe 2588 rundll32.exe -
Loads dropped DLL 9 IoCs
pid Process 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 2096 rundl32.exe 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 2752 WerFault.exe 2752 WerFault.exe 2752 WerFault.exe 2752 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe" 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2096 set thread context of 2660 2096 rundl32.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2752 2588 WerFault.exe 33 -
Runs net.exe
-
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2192 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 28 PID 2348 wrote to memory of 2192 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 28 PID 2348 wrote to memory of 2192 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 28 PID 2348 wrote to memory of 2192 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 28 PID 2192 wrote to memory of 2984 2192 net.exe 30 PID 2192 wrote to memory of 2984 2192 net.exe 30 PID 2192 wrote to memory of 2984 2192 net.exe 30 PID 2192 wrote to memory of 2984 2192 net.exe 30 PID 2348 wrote to memory of 2096 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 31 PID 2348 wrote to memory of 2096 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 31 PID 2348 wrote to memory of 2096 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 31 PID 2348 wrote to memory of 2096 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 31 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2096 wrote to memory of 2660 2096 rundl32.exe 32 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2348 wrote to memory of 2588 2348 189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe 33 PID 2588 wrote to memory of 2752 2588 rundll32.exe 34 PID 2588 wrote to memory of 2752 2588 rundll32.exe 34 PID 2588 wrote to memory of 2752 2588 rundll32.exe 34 PID 2588 wrote to memory of 2752 2588 rundll32.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\SysWOW64\net.exe"C:\windows\system32\net.exe" stop wscsvc2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc3⤵PID:2984
-
-
-
C:\Users\Admin\AppData\Local\Temp\rundl32.exe"C:\Users\Admin\AppData\Local\Temp\rundl32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\rundl32.exe"C:\Users\Admin\AppData\Local\Temp\rundl32.exe"3⤵
- Executes dropped EXE
PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\rundll32.exe"C:\Users\Admin\AppData\Local\Temp\rundll32.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1963⤵
- Loads dropped DLL
- Program crash
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD59b317cf75128dae3257f5c9988092953
SHA1546565818b33ba4037daf36f86a892deefa719a6
SHA2566e84427e3d38c26da42eb64c209ec615caa7f62d73b0bda9f2c9ab530513221d
SHA5120c7d3a6c3e679797cc2cb5e15c634544c6c9dccd9c1772a8227a9895a6b09759fe6c373767f082f2b7e21f5a619cda07078011697040ca6c3cf4b4ce19f5d0c8
-
Filesize
36KB
MD5fe7285a11b8ef5158383b3fcc3a63fb1
SHA1f3aacd6ae45e24c593883a1109dd6fcb6ac8e7a6
SHA256c9a2ee86e317978b235483bbf55b3b1c4b9aa2a4ed127a1f73ccc72e06ba17ae
SHA5124ad5832042bbcbf8a35522d9f871338a6d5341d9f2cea5cbb5f0b67d48defa05dd80d5353bc6395e84e52d759c144cddde48bc411c4fb25f44bbb87c99fd1628