Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 13:36
Behavioral task
behavioral1
Sample
2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe
-
Size
296KB
-
MD5
2c8d7818a17eb2392216304a89925320
-
SHA1
dfd13015fca86e0300f916a6bcc26790dcd908e9
-
SHA256
ca8ade758f6b59bbc129b091c743b59e912e759fb412a650ef3180e582deca33
-
SHA512
4b51f42cc6ba1d26ad5736ae131bf23000e1237aedd78429c4625af6ee5cb75b353be52d1bb02b4b309ba1f68a21f7e91a6ef63c5369cf6410f7ccc05331d9c1
-
SSDEEP
6144:F9raWFVyqQYj77MNQCzX1fwejjgKhwyW6pAgwdUuKKqKHCUqn4SXq:PaWVrT77MNQCzOmjFW4ApUuKKqKHCbb
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1704 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2804 fimi.exe -
Loads dropped DLL 2 IoCs
pid Process 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2244-0-0x0000000000400000-0x0000000000813000-memory.dmp upx behavioral1/files/0x0009000000016de1-6.dat upx behavioral1/memory/2244-12-0x0000000002650000-0x0000000002A63000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\{F4363D88-6FEF-AD4F-FCEF-4765F9626478} = "C:\\Users\\Admin\\AppData\\Roaming\\Qituq\\fimi.exe" fimi.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2244 set thread context of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Privacy 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe 2804 fimi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe Token: SeSecurityPrivilege 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe Token: SeSecurityPrivilege 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2804 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 30 PID 2244 wrote to memory of 2804 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 30 PID 2244 wrote to memory of 2804 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 30 PID 2244 wrote to memory of 2804 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 30 PID 2804 wrote to memory of 1104 2804 fimi.exe 19 PID 2804 wrote to memory of 1104 2804 fimi.exe 19 PID 2804 wrote to memory of 1104 2804 fimi.exe 19 PID 2804 wrote to memory of 1104 2804 fimi.exe 19 PID 2804 wrote to memory of 1104 2804 fimi.exe 19 PID 2804 wrote to memory of 1172 2804 fimi.exe 20 PID 2804 wrote to memory of 1172 2804 fimi.exe 20 PID 2804 wrote to memory of 1172 2804 fimi.exe 20 PID 2804 wrote to memory of 1172 2804 fimi.exe 20 PID 2804 wrote to memory of 1172 2804 fimi.exe 20 PID 2804 wrote to memory of 1208 2804 fimi.exe 21 PID 2804 wrote to memory of 1208 2804 fimi.exe 21 PID 2804 wrote to memory of 1208 2804 fimi.exe 21 PID 2804 wrote to memory of 1208 2804 fimi.exe 21 PID 2804 wrote to memory of 1208 2804 fimi.exe 21 PID 2804 wrote to memory of 2036 2804 fimi.exe 23 PID 2804 wrote to memory of 2036 2804 fimi.exe 23 PID 2804 wrote to memory of 2036 2804 fimi.exe 23 PID 2804 wrote to memory of 2036 2804 fimi.exe 23 PID 2804 wrote to memory of 2036 2804 fimi.exe 23 PID 2804 wrote to memory of 2244 2804 fimi.exe 29 PID 2804 wrote to memory of 2244 2804 fimi.exe 29 PID 2804 wrote to memory of 2244 2804 fimi.exe 29 PID 2804 wrote to memory of 2244 2804 fimi.exe 29 PID 2804 wrote to memory of 2244 2804 fimi.exe 29 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31 PID 2244 wrote to memory of 1704 2244 2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe 31
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c8d7818a17eb2392216304a89925320_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Roaming\Qituq\fimi.exe"C:\Users\Admin\AppData\Roaming\Qituq\fimi.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp75bbc070.bat"3⤵
- Deletes itself
PID:1704
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271B
MD52f33c3944df195bc3ed9638a0d8721f1
SHA1fcf48de59d5b047bae52c1bb454703680f8a450b
SHA256ab4e4a561433faf57c063cf0c2edfa8e9d84e4e3db229c2ce0d3fb714bba41f9
SHA5128a53cb91a518ecd608f72178da040e8ffb3079762e8d4265708fc2c19d5a4316ca138e05e2d64bc463c3ab4c3d30890f23f4946420b7dee96e427fd583ce1259
-
Filesize
380B
MD53b5dafc445308fc01807ac874c10839a
SHA18cd9313e7e8671bb079011b297e6b3d1023d74b5
SHA2569ef61b58ba70c4c3d85eb24944528eee6bff13089e8807fed4eaa522f006baab
SHA5120ebe17467d2cbb80b74edb53b177f7aeac8371f95683d50da3df6cce7cfb5ea5f933751a2baabd9ddccdab5f5d90989d59a39ec30daa5b755ff7e91e30a69221
-
Filesize
296KB
MD5efd5a909566cd79c4f016ec5494ac6f2
SHA159167cb97763fa2f5bb11483cf0de82519db054d
SHA25643476de3006cb58bc932f08d7da87fed9970032f51fd78d04ed9b6d0396a9938
SHA512f3992ae8be6d984f0ef350344532678b0fe956cfa0f6c657af416abbb9dbc05c8aeeb64b04954c34f77ed5dd468f055cfdce4f4a5d72beabeb78ddb1f5d31ce1