Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 12:38
Static task
static1
Behavioral task
behavioral1
Sample
306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
General
-
Target
306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe
-
Size
487KB
-
MD5
306760d2c97dabe6bd64a0920cc7bb83
-
SHA1
712e1d1bf52c110952a3fbfcb614b0864eae97ab
-
SHA256
fa5edc960cd8117171cd6e3a16cbbcfa7fb6252bfd2fe498f92ed43f50ab7de8
-
SHA512
12dd29912021228d2d9fba8b3738f136952f01d0320ecf56528de0e88cacf1d53e631616b58a3c42f78a24d0c77e724e21e4de3ccc7bf52873b116586d57c33f
-
SSDEEP
12288:OczJJhqrVPa3V4axl9DRLt0pBf1e51O6H5SV9zFhit:OczJqVS3aaxl7Re9+sXhit
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2128 server_n.exe 2116 mservice32.exe -
Loads dropped DLL 4 IoCs
pid Process 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 2128 server_n.exe 2128 server_n.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UpdateN = "C:\\Users\\Admin\\AppData\\Roaming\\mservice32.exe" mservice32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe 2116 mservice32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 1464 wrote to memory of 2128 1464 306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2116 2128 server_n.exe 31 PID 2128 wrote to memory of 2116 2128 server_n.exe 31 PID 2128 wrote to memory of 2116 2128 server_n.exe 31 PID 2128 wrote to memory of 2116 2128 server_n.exe 31 PID 2128 wrote to memory of 2116 2128 server_n.exe 31 PID 2128 wrote to memory of 2116 2128 server_n.exe 31 PID 2128 wrote to memory of 2116 2128 server_n.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\306760d2c97dabe6bd64a0920cc7bb83_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\server_n.exe"C:\Users\Admin\AppData\Local\Temp\server_n.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Roaming\mservice32.exe"C:\Users\Admin\AppData\Roaming\mservice32.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
917KB
MD55e848b9fb9375bb0aa52b95ae538fa3c
SHA12e590e81408b7c9af0486e62630eb68464286867
SHA256f75857122e53cded85b5827384a4b769b273c7f2a1c3edd0fcff7ffdb222103b
SHA5122df691e38e450a4251dbe2a6d9d0b8930b0d3ecb163a898f4bcd55f60da019a9a7d7095e6070b9b7206589125a0ac5463a305e427114425be762fe8fa9c39af7