Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
27741e396045ff762288d6d0e384358e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
27741e396045ff762288d6d0e384358e_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27741e396045ff762288d6d0e384358e_JaffaCakes118.exe
-
Size
80KB
-
MD5
27741e396045ff762288d6d0e384358e
-
SHA1
2e88e014264b28eb025385686763ae66a32191aa
-
SHA256
324fb02e7aabaae28dced39d680c0819cb3986908726088a6584e572f745c9da
-
SHA512
6ba2da28922a9219c2611800c45446ee1aaa0e2729bbd8599f9f44bdf9e3cb269ced9f5c33c0352082603e0b107015e760b27597e9799b165fc15d8e4bcf2f0d
-
SSDEEP
1536:/gWgWt5NCgrLvk6JKLe7+nB7stedqiDV8Z3anehf9jMSEgluqdJ:4Wlt5sgAyABwtedqRxVjXVdJ
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\drivers\\BSqBT.exe" 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe -
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\BSqBT.exe 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\BSqBT.exe BSqBT.exe File created C:\Windows\SysWOW64\drivers\BSqBT.exe BSqBT.exe File created C:\Windows\SysWOW64\drivers\BSqBT.exe 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2576 BSqBT.exe 2524 BSqBT.exe -
Loads dropped DLL 3 IoCs
pid Process 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 2576 BSqBT.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\drivers\\BSqBT.exe" 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1640 set thread context of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 2576 set thread context of 2524 2576 BSqBT.exe 30 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\logfile32.txt BSqBT.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1640 wrote to memory of 1896 1640 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 28 PID 1896 wrote to memory of 2576 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 29 PID 1896 wrote to memory of 2576 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 29 PID 1896 wrote to memory of 2576 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 29 PID 1896 wrote to memory of 2576 1896 27741e396045ff762288d6d0e384358e_JaffaCakes118.exe 29 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30 PID 2576 wrote to memory of 2524 2576 BSqBT.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\27741e396045ff762288d6d0e384358e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27741e396045ff762288d6d0e384358e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\27741e396045ff762288d6d0e384358e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27741e396045ff762288d6d0e384358e_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\drivers\BSqBT.exe"C:\Windows\system32\drivers\BSqBT.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\drivers\BSqBT.exe"C:\Windows\system32\drivers\BSqBT.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
PID:2524
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD527741e396045ff762288d6d0e384358e
SHA12e88e014264b28eb025385686763ae66a32191aa
SHA256324fb02e7aabaae28dced39d680c0819cb3986908726088a6584e572f745c9da
SHA5126ba2da28922a9219c2611800c45446ee1aaa0e2729bbd8599f9f44bdf9e3cb269ced9f5c33c0352082603e0b107015e760b27597e9799b165fc15d8e4bcf2f0d