Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 04:51
Static task
static1
Behavioral task
behavioral1
Sample
335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe
-
Size
34KB
-
MD5
335bfcbe99d4267a35c737c79b2810cc
-
SHA1
4b856dcc3e4918a3a5102b778eacde0ec1fbb669
-
SHA256
b6382f9c2d9982d942c7759e6f3b2d8524cce520227cecea8fa69a103d64698f
-
SHA512
6695992c1d413e0a62214f29a9ce8f544c0bad2debd93867a333be23e55e20fbbda3df07e6b7613b6b00ba8c19ef80da4fa3ae66d0ce6d1b7f96aba7494f7450
-
SSDEEP
768:cflivXrVKpVhKvtxwYHwVFoeAQGmucwU9:ylqrVKprVuQGq
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2776 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2060 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 2060 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\522d97c3\522d97c3 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe File created C:\Program Files (x86)\522d97c3\jusched.exe 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe 2776 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2776 2060 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2776 2060 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2776 2060 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2776 2060 335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\335bfcbe99d4267a35c737c79b2810cc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\522d97c3\jusched.exe"C:\Program Files (x86)\522d97c3\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
34KB
MD520dda21ca061d5c585086693fd831adf
SHA12b2cb5a3a9d00ac7117e0df3cee678bd838f1392
SHA2560cde36d56029c611d5ab2b238059e46a12a0dd5317efefb0ec6fceba4fceee4f
SHA5123286ae61fed29f6a607389fd018012fbc8033aee3fc0dfdac934ac2e9d08bc2799637720ee0ca060b4678ab3bb1eb2f46335e42c2b4281dd5f9757603570b678