Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 19:14
Behavioral task
behavioral1
Sample
31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe
-
Size
138KB
-
MD5
31a2522b691819aef0777f5d3ad8b822
-
SHA1
76dfc3ed82135589595c1839ea6513537b2c87e2
-
SHA256
1e220ae5de5671e1383f6a793621dc30f3be1553c3496a61ca99f1b0d39f0dce
-
SHA512
64038ce72198e081b5127b5b36fdb9d8a5f441866191c617a25334841846477540b7b4b4640eaf632e3712bb8e7222bd6a8b2edf9171f6d16a5db529e7519f02
-
SSDEEP
3072:bVOmv3843n6MGIIznDLBNR3X4Zngtybpq:bgU84yVLBNRYZgm
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 2064 31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe 2364 Svchost.exe -
resource yara_rule behavioral1/memory/2064-0-0x0000000001110000-0x0000000001136000-memory.dmp upx behavioral1/files/0x0008000000015fa3-6.dat upx behavioral1/memory/2364-11-0x0000000074BB0000-0x0000000074BD6000-memory.dmp upx behavioral1/memory/2364-13-0x0000000074BB0000-0x0000000074BD6000-memory.dmp upx behavioral1/memory/2064-14-0x0000000001110000-0x0000000001136000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\3E5704AC.tmp 31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2064 31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31a2522b691819aef0777f5d3ad8b822_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:2364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
724B
MD5ccc785e44d84c30da8f9a5ef427d6b69
SHA1eea24ece060e13cb2bcbf81f7d61e6ea7ee34fba
SHA25638fc8626e8538aa853d5e3559eb488ccc3b1df16e63647498b9b25100a047635
SHA512a45f872e19c2092f02a3d9e253cf6f7de2c7a454f15f983d031d113e79a1cfa607055376e82d368b8b61b074e8e0496751f50ebba8d314bbca4e816f418d0f09
-
Filesize
138KB
MD53130622b2b74522d31ad36c92e8cd512
SHA1f8e6fec47fee76372a82dd78c47eab45fef5c6c8
SHA2561c22f9d1a389245cd9ee4588ef39c7f8ad7c1eda5283b18daf551013c76658d5
SHA5120b06ac1aca37b6b0d7eb1c5c0523ba920109588b9174b2f06829e16d6533575dcae562fa24a4438ba51f29cbbddff09f327e0f181b100aecdf1ae058ca30d8e6