Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
3808287657286cad978f473a3cf3917d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3808287657286cad978f473a3cf3917d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3808287657286cad978f473a3cf3917d_JaffaCakes118.exe
-
Size
731KB
-
MD5
3808287657286cad978f473a3cf3917d
-
SHA1
687016c36a133189a598c2768cc98b2cd6e79b10
-
SHA256
8f7662ee33125eb7c8d53eb7b358aeb6451af51cd30cefd21fe9cd31b5397725
-
SHA512
aba448bdca1a63729ff4e5cafe1eee9a0f486d7928b3a6e1f19fcf9c7e1f0382019eee2968e8200fe42bf01c986c9d1bf458458e107afd39e907aeca2aea188a
-
SSDEEP
12288:Jaingtd/9iCpVEZxzraxdUdpmsFmjnDgGeIttwoPR5pWZhAIRXHYnrmm:JaigD/ArravUdsswnlFttwYQRXHYrmm
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 888 netsh.exe 2072 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2300 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 28 PID 2160 wrote to memory of 2300 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 28 PID 2160 wrote to memory of 2300 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 28 PID 2160 wrote to memory of 2300 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 28 PID 2160 wrote to memory of 2432 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 30 PID 2160 wrote to memory of 2432 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 30 PID 2160 wrote to memory of 2432 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 30 PID 2160 wrote to memory of 2432 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 30 PID 2160 wrote to memory of 2964 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2964 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2964 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2964 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 32 PID 2964 wrote to memory of 2072 2964 cmd.exe 34 PID 2964 wrote to memory of 2072 2964 cmd.exe 34 PID 2964 wrote to memory of 2072 2964 cmd.exe 34 PID 2964 wrote to memory of 2072 2964 cmd.exe 34 PID 2160 wrote to memory of 2096 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 35 PID 2160 wrote to memory of 2096 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 35 PID 2160 wrote to memory of 2096 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 35 PID 2160 wrote to memory of 2096 2160 3808287657286cad978f473a3cf3917d_JaffaCakes118.exe 35 PID 2096 wrote to memory of 888 2096 cmd.exe 37 PID 2096 wrote to memory of 888 2096 cmd.exe 37 PID 2096 wrote to memory of 888 2096 cmd.exe 37 PID 2096 wrote to memory of 888 2096 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\3808287657286cad978f473a3cf3917d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3808287657286cad978f473a3cf3917d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:2300
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2432
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2072
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:888
-
-