Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 07:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe
-
Size
6.8MB
-
MD5
251d47c6c5b262f0a57bce4294bf825f
-
SHA1
e6fd5fb10b1a78ce794d6019530973f1bf4575a7
-
SHA256
cb348a703776a182106d9b815518bef89cd9dacb5775b5450516239f31e77a35
-
SHA512
c06d7f9cc07cd63d41d415dc115ee8378a63af8522a7e6b2a9d745d2e2522e32baa9c98396a9d96c97f865c2f7195894c10e4159cbb921872e6c5338e25b96cf
-
SSDEEP
6144:c5/w3Ewpu5r5FA8XXlREZyv6dxAV5iLz:c5wTpaXXlRQVpLz
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2428 audiod.exe 996 audiod.exe -
Loads dropped DLL 3 IoCs
pid Process 1256 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 1256 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 2428 audiod.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\Users\\Admin\\AppData\\Local\\Temp\\audiod.exe" audiod.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2160 set thread context of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2428 set thread context of 996 2428 audiod.exe 30 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe 996 audiod.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 2428 audiod.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 2160 wrote to memory of 1256 2160 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 28 PID 1256 wrote to memory of 2428 1256 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 29 PID 1256 wrote to memory of 2428 1256 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 29 PID 1256 wrote to memory of 2428 1256 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 29 PID 1256 wrote to memory of 2428 1256 251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe 29 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30 PID 2428 wrote to memory of 996 2428 audiod.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\251d47c6c5b262f0a57bce4294bf825f_JaffaCakes118.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\audiod.exe"C:\Users\Admin\AppData\Local\Temp\audiod.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\audiod.exeC:\Users\Admin\AppData\Local\Temp\audiod.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:996
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5251d47c6c5b262f0a57bce4294bf825f
SHA1e6fd5fb10b1a78ce794d6019530973f1bf4575a7
SHA256cb348a703776a182106d9b815518bef89cd9dacb5775b5450516239f31e77a35
SHA512c06d7f9cc07cd63d41d415dc115ee8378a63af8522a7e6b2a9d745d2e2522e32baa9c98396a9d96c97f865c2f7195894c10e4159cbb921872e6c5338e25b96cf