Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 04:23
Behavioral task
behavioral1
Sample
3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe
-
Size
28KB
-
MD5
3348f375aee8ca086bd9d3b198704317
-
SHA1
14949f79bde3eaf6a8cf4746825fa088086d3f86
-
SHA256
743461bc76ac2964a0c31a01155ac9bc77c94bb0319f3188d7f55d492a64d64c
-
SHA512
4fe408cc9d2622dc718a170d6e74e91d277f815092d61efe5a4d31150f519f8b7b628700f203ddd6d4628bd370ca60e7679cb8ebdbca248f81dadc1a3e5658a1
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNoCpk:Dv8IRRdsxq1DjJcqffUk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2696 services.exe -
resource yara_rule behavioral1/memory/280-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/280-4-0x0000000000220000-0x0000000000228000-memory.dmp upx behavioral1/files/0x0008000000016eb4-9.dat upx behavioral1/memory/280-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2696-17-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-22-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-28-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-30-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-35-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-40-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-42-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/280-46-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2696-47-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-52-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/files/0x0031000000016db0-57.dat upx behavioral1/memory/280-67-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2696-68-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/280-71-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2696-72-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/280-76-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2696-77-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2696-79-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/280-83-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2696-84-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe File opened for modification C:\Windows\java.exe 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe File created C:\Windows\java.exe 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 280 wrote to memory of 2696 280 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe 30 PID 280 wrote to memory of 2696 280 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe 30 PID 280 wrote to memory of 2696 280 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe 30 PID 280 wrote to memory of 2696 280 3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3348f375aee8ca086bd9d3b198704317_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f247e829fa0e6ec87185fa533635422a
SHA19d8231e05536a36fbd6d9a17b68df725c90ba1dd
SHA256152e7176d16cf4faaf4b43d572b4a092ee9cddf6de5c69ab5c91de43d4cf77bb
SHA512f683791a160d96f970e836e5a658c90158f14765a5d68635a67488c5d0b999bc1149eb41f100452a56c9a61676c71643973ce58b52ffed8581a2ab9d551fc3b8
-
Filesize
28KB
MD557db42589c42000c4800848d66675393
SHA10018007aa9f002267f76ffad6b39b3305d048bfd
SHA2567b2d4f7a622e6a610f878d6b80d4717119659c90a6cda1ee4e4da117751f0b76
SHA5122d41cc593a1bc603c00bf28a9b79d86fe7a9f4c70fb0d234aeb6f20724573a494d3ecf48b16c08545b03df00aeee914b51fd3f06a0eee9d649622a277c4df445
-
Filesize
1KB
MD5117243bf6bb226d3f1a46b816b5da064
SHA19e0f4cb2da4ee101b4d1869759609821cf527390
SHA25629d3087afb6f5252a9f740a20353e0f00f68c5131c0dbb854a161c5171684889
SHA5127f3cdd87388d249391ca1b94d837f472ad14890edf9617e24f5c78d0ceffdafd966486f0e74961806ef2b7e66939624983c078cb756a7b9f01b576fe682d46f1
-
Filesize
1KB
MD5423d0168956b46446e9a8242e18c9653
SHA17cab51fd8e7d20d15f494d2d601a5d8bc371ad10
SHA256a83867f5207cc61515d917740cb930a902c7225fc99ac53c2fd2e51a254668da
SHA512460882fd9c5dcce3456032aa1a6cdb3a77e433b0cbadacfd2ea097bb5f2b3680db1fc142bfa39c2fbbcf370bbd669732e8fcdc9c42dcb50d7b0953282522686c
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2