Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe
-
Size
862KB
-
MD5
3b3c19e3fac4b69c8ebffafb7043c5bd
-
SHA1
e04b2fde5f4c83df0d819314a1846ac7f3ad61b2
-
SHA256
8c7069790c6cc6997180516b9ae515d35743f51ac4e6995a9b960a41dfbb8200
-
SHA512
f0bb2188af26ae5a0a6c98576afb218a2d09bd13abdf633fc2bbb8439a4761d19314408551086ef08c39b0fe9fa5570d64c8e1eb539f023293b69fe266fe2ed7
-
SSDEEP
24576:f4P/gzEt/GaG93cnFBcKa+VHQ15CmD/v8rS:f4P/MEt/bnFBcKa+VHQ15f/UrS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2644 isecurity.exe -
Loads dropped DLL 3 IoCs
pid Process 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security = "C:\\ProgramData\\isecurity.exe" isecurity.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: isecurity.exe File opened (read-only) \??\T: isecurity.exe File opened (read-only) \??\V: isecurity.exe File opened (read-only) \??\P: isecurity.exe File opened (read-only) \??\Y: isecurity.exe File opened (read-only) \??\Z: isecurity.exe File opened (read-only) \??\K: isecurity.exe File opened (read-only) \??\M: isecurity.exe File opened (read-only) \??\O: isecurity.exe File opened (read-only) \??\J: isecurity.exe File opened (read-only) \??\L: isecurity.exe File opened (read-only) \??\Q: isecurity.exe File opened (read-only) \??\S: isecurity.exe File opened (read-only) \??\X: isecurity.exe File opened (read-only) \??\E: isecurity.exe File opened (read-only) \??\H: isecurity.exe File opened (read-only) \??\I: isecurity.exe File opened (read-only) \??\W: isecurity.exe File opened (read-only) \??\N: isecurity.exe File opened (read-only) \??\R: isecurity.exe File opened (read-only) \??\U: isecurity.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 isecurity.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe 2644 isecurity.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2644 isecurity.exe 2644 isecurity.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2644 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 30 PID 2072 wrote to memory of 2644 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 30 PID 2072 wrote to memory of 2644 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 30 PID 2072 wrote to memory of 2644 2072 3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b3c19e3fac4b69c8ebffafb7043c5bd_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\ProgramData\isecurity.exeC:\ProgramData\isecurity.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854KB
MD582ac2f6fcb46f60fc20b3afa5d16e499
SHA1c27247f7efc157f1a4eaffedbfcc458f6961763f
SHA256af57d848b749babe1daf6b7fbef1755d7954bfe53691f7f0134cac7476907872
SHA5123c1a7345a6c7f448ca4cc7ee7b0f2691f56d12e009a90d0d39e7b319e55e1bb5a4c21e32bb7d9213c903c4f575f38427e61e191c24e443de5f8ace4f39412d8d