Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe
-
Size
728KB
-
MD5
2f5519a0b51c9a3f491e56eedcbd615d
-
SHA1
15fd601d0ca00e8623742788e6e0e933e0fdf17b
-
SHA256
4d12d1a83b5392d1c188d47409dfdb978fe2179bdcf18f77ee65ead254543be8
-
SHA512
35e1743509119ff9b556978bdcda5a72142bf5b5e7d732282db41b43edd5ffc9836e4237c772e31244768489306f7c79e44c96fcfb248f008a5b86a9ee840be6
-
SSDEEP
12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMUmmcKDgGeItoEc9GspWZhASRXHYnrm/:z2QSmCrmgHCmKqMUkKlFtov9GsqRXHYg
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1924 netsh.exe 2844 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1324 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 31 PID 1984 wrote to memory of 1324 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 31 PID 1984 wrote to memory of 1324 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 31 PID 1984 wrote to memory of 1324 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 31 PID 1984 wrote to memory of 2464 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 33 PID 1984 wrote to memory of 2464 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 33 PID 1984 wrote to memory of 2464 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 33 PID 1984 wrote to memory of 2464 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 33 PID 1984 wrote to memory of 2892 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 35 PID 1984 wrote to memory of 2892 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 35 PID 1984 wrote to memory of 2892 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 35 PID 1984 wrote to memory of 2892 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 35 PID 2892 wrote to memory of 1924 2892 cmd.exe 37 PID 2892 wrote to memory of 1924 2892 cmd.exe 37 PID 2892 wrote to memory of 1924 2892 cmd.exe 37 PID 2892 wrote to memory of 1924 2892 cmd.exe 37 PID 1984 wrote to memory of 2712 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 38 PID 1984 wrote to memory of 2712 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 38 PID 1984 wrote to memory of 2712 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 38 PID 1984 wrote to memory of 2712 1984 2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe 38 PID 2712 wrote to memory of 2844 2712 cmd.exe 40 PID 2712 wrote to memory of 2844 2712 cmd.exe 40 PID 2712 wrote to memory of 2844 2712 cmd.exe 40 PID 2712 wrote to memory of 2844 2712 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2464
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1924
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2844
-
-