Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe
-
Size
217KB
-
MD5
34c6c16ff04a6e3f21258e591aa36b1d
-
SHA1
666e6c5f30c76891ec02e5616a3dc53c30ccfd30
-
SHA256
f62250be625fa9c7ba1d7f31cf3f4e2f723a8c32a056a6eeef8f15360619e4b2
-
SHA512
fdb7446a96c67a366271f0154aad2c9a7c1eb901f583f92c643bb5c5823bcdfe02c8c4a84d66ee0941a83a6968d66faf041b163f58f90818a677d5cf159bacb3
-
SSDEEP
3072:1gRYSzZ+518CpxoPL7nYqQ8Xx0BpFJti4VPCr3WHYvGE8a0A+te:6/vCp6TrYqQ8XOBpzbYgYX8a0E
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2688 explore.exe 2916 winlog.exe -
Loads dropped DLL 3 IoCs
pid Process 2688 explore.exe 2688 explore.exe 2688 explore.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlog.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winlog.exe" winlog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 672 wrote to memory of 2688 672 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 30 PID 672 wrote to memory of 2688 672 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 30 PID 672 wrote to memory of 2688 672 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 30 PID 672 wrote to memory of 2688 672 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 30 PID 2688 wrote to memory of 2916 2688 explore.exe 31 PID 2688 wrote to memory of 2916 2688 explore.exe 31 PID 2688 wrote to memory of 2916 2688 explore.exe 31 PID 2688 wrote to memory of 2916 2688 explore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\explore.exe"C:\Users\Admin\AppData\Local\Temp\explore.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD547ecfdf73d15deaeef79e13a16afdd29
SHA16bb2355e596b525d25c18917fab6ca12df2b583e
SHA256d9cf0badf82a33c8e5c723ef6be77febc7db79955a411383a1b7ba3ffcd1af6c
SHA512dd22a14d80a8563748c0de543df1e119ef7566a6b5be40e081d4505dfc213555268b93bf028f1557679f7200b3ff7f95dd557a44b283165e5366e33f7ac9581b