Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe
-
Size
728KB
-
MD5
306ae1767544f8472250405ad0a2661d
-
SHA1
e94091b70c4641039f000c9a84bfd02055a69adb
-
SHA256
bd68d0a20951e0c32ee5e259c698e9d072438eaaf945cc732ead83e4c73dc95e
-
SHA512
e5d39ff53128cca4b07abf13480b6426e8193361d3c61c608e9d4b1012e78805258ba87bd6a1bffff87dc29883b9a856fce06bd937ec43512a1f6b045c25026f
-
SSDEEP
12288:lEcF8D2K53tGcAOYYsLN2Z8bbXc/meGDgGeItoEc9GspWZhASRXHYnrm/:lEc8H5fMLN2Kb7crGlFtov9GsqRXHYr4
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2768 netsh.exe 2900 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2396 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 30 PID 1672 wrote to memory of 2396 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 30 PID 1672 wrote to memory of 2396 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 30 PID 1672 wrote to memory of 2396 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 30 PID 1672 wrote to memory of 2808 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 32 PID 1672 wrote to memory of 2808 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 32 PID 1672 wrote to memory of 2808 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 32 PID 1672 wrote to memory of 2808 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 32 PID 1672 wrote to memory of 2132 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 34 PID 1672 wrote to memory of 2132 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 34 PID 1672 wrote to memory of 2132 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 34 PID 1672 wrote to memory of 2132 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 34 PID 2132 wrote to memory of 2768 2132 cmd.exe 36 PID 2132 wrote to memory of 2768 2132 cmd.exe 36 PID 2132 wrote to memory of 2768 2132 cmd.exe 36 PID 2132 wrote to memory of 2768 2132 cmd.exe 36 PID 1672 wrote to memory of 2912 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 37 PID 1672 wrote to memory of 2912 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 37 PID 1672 wrote to memory of 2912 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 37 PID 1672 wrote to memory of 2912 1672 306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe 37 PID 2912 wrote to memory of 2900 2912 cmd.exe 39 PID 2912 wrote to memory of 2900 2912 cmd.exe 39 PID 2912 wrote to memory of 2900 2912 cmd.exe 39 PID 2912 wrote to memory of 2900 2912 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\306ae1767544f8472250405ad0a2661d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:2396
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2768
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2900
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD5e1098470152dc10fb29b3ad7b4e5f5cf
SHA1ae5a796340be8f0912d6c85f81dce21211aaaf15
SHA2563832d19f80a84069c5010266fa3cf11eee5bb1c3d1b2ba278e49519519561b8a
SHA5120ba3a53a3021be99aaf5cf8af54f214feea0f80f112a7ffb209b4c2c0539f8b8b6cd087ba7ed6501c9b79e0a9496494e471ac43f9b7f0aacf58866c01e90e7c6