Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe
-
Size
313KB
-
MD5
195d9ddaf6899d07d0e9d8995d9771c2
-
SHA1
a7e30274e3ca6442439ce55d04f10614fc7fd2bd
-
SHA256
e0ad94f556f040ea71474e5718df60e4f718a317dfbc4676cab05bef15a103c3
-
SHA512
3879a524357b8f68704d018a9e197c91a293b225e78142d64fb081e329c864775f096708956080d58567d2f259714bdc3a6cba6d83a17481a8ad163a0bc1ef5d
-
SSDEEP
6144:wgyYicDiXgOHhm6YaFuX1qtpQKC8A1V9QTpwLZ8L9S+pdupjk:Jc0SgiXYaFwo28AOTEZ8f2e
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1044 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3008 dohhrg.exe -
Loads dropped DLL 3 IoCs
pid Process 1044 cmd.exe 1044 cmd.exe 3008 dohhrg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2692 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2496 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2692 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe 3008 dohhrg.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1044 2148 195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe 28 PID 2148 wrote to memory of 1044 2148 195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe 28 PID 2148 wrote to memory of 1044 2148 195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe 28 PID 2148 wrote to memory of 1044 2148 195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe 28 PID 1044 wrote to memory of 2692 1044 cmd.exe 30 PID 1044 wrote to memory of 2692 1044 cmd.exe 30 PID 1044 wrote to memory of 2692 1044 cmd.exe 30 PID 1044 wrote to memory of 2692 1044 cmd.exe 30 PID 1044 wrote to memory of 2496 1044 cmd.exe 32 PID 1044 wrote to memory of 2496 1044 cmd.exe 32 PID 1044 wrote to memory of 2496 1044 cmd.exe 32 PID 1044 wrote to memory of 2496 1044 cmd.exe 32 PID 1044 wrote to memory of 3008 1044 cmd.exe 33 PID 1044 wrote to memory of 3008 1044 cmd.exe 33 PID 1044 wrote to memory of 3008 1044 cmd.exe 33 PID 1044 wrote to memory of 3008 1044 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2148 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\195d9ddaf6899d07d0e9d8995d9771c2_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\dohhrg.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 21483⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2496
-
-
C:\Users\Admin\AppData\Local\dohhrg.exeC:\Users\Admin\AppData\Local\dohhrg.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3008
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD5195d9ddaf6899d07d0e9d8995d9771c2
SHA1a7e30274e3ca6442439ce55d04f10614fc7fd2bd
SHA256e0ad94f556f040ea71474e5718df60e4f718a317dfbc4676cab05bef15a103c3
SHA5123879a524357b8f68704d018a9e197c91a293b225e78142d64fb081e329c864775f096708956080d58567d2f259714bdc3a6cba6d83a17481a8ad163a0bc1ef5d