Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe
-
Size
287KB
-
MD5
293c2349735db79bc4bee12fd734bf97
-
SHA1
7dcba977ee39c635543ac6270a0a1b80fbe67a19
-
SHA256
b5407e3da8818734c11375264877000fd6211c4d478495a126db688263a3e73c
-
SHA512
6be66f9692f3f11dd7e815590b22aaf4517396fc8d69c9c2cfa3d2067ea0688fcacf29d1fc7727b173f3d58ff76dd37446a9e7e377de695edfabe663c500e47d
-
SSDEEP
6144:BMo5z4p66GQs77stVURLgt08ZB0G32xN/EMlYUvJI9:BMWz4p66y3stVGgtvZSG3S/5lNRy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2084 MSSQL.exe -
Loads dropped DLL 2 IoCs
pid Process 2064 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe 2064 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command MSSQL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWOW64\\MSSQL.exe \"%1\" %*" MSSQL.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSSever = "C:\\Windows\\SysWOW64\\MSSQL.exe" MSSQL.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSSQL.exe 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command MSSQL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWOW64\\MSSQL.exe \"%1\" %*" MSSQL.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe 2084 MSSQL.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2084 2064 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe 31 PID 2064 wrote to memory of 2084 2064 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe 31 PID 2064 wrote to memory of 2084 2064 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe 31 PID 2064 wrote to memory of 2084 2064 293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\293c2349735db79bc4bee12fd734bf97_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\MSSQL.exeC:\Windows\system32\MSSQL.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
194KB
MD551f176b6a0617e60af49fd19b59664f2
SHA1a3d6d37021d6493acdc2dcb16507b652836cf7f9
SHA25617f6bb80b77ec28fc4ebc8d02dd7e3403323f360e9a2028da088c26c858d750e
SHA512e5d546883f16cbe8e5e340dd2d60e4435781b2f1348f16a7ad6c88abb652e1c2ae3641e5564bcc11d0ae48eb129260cb50931a69ce52dfe42c26403f1b805811