Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe
-
Size
120KB
-
MD5
3b7d5efed48dc0eb9e36311ee4800e98
-
SHA1
49b78f8eb1d1affe912d986c8b3b85075faa53a7
-
SHA256
356b0df6e66f034a7fa363b1367c1c90191e3d829df36b20ed154086d77179c4
-
SHA512
c46142526ab40ac4d97c7d15ad25efb10690b69455b83b2f18973b84cd749c0e5149617a24b2cbbba5585c7fae987864d5932087de7b15406c821ca0471d4233
-
SSDEEP
1536:OKS9Ao2U1o6dPKCk9hy0za06QxcwId8LPskTOij+YUqvXMwEnw:OKYAo71o6M3O0G06QDDsmOijr
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe" 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 2936 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2936 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 31 PID 2880 wrote to memory of 2936 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 31 PID 2880 wrote to memory of 2936 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 31 PID 2880 wrote to memory of 2936 2880 3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3b7d5efed48dc0eb9e36311ee4800e98_JaffaCakes118.exe2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130B
MD5c55bc2d56dfbc254ac5d8f09564b6c76
SHA17d14c976a8971942a48de37e7a8d63969d412b06
SHA2560b9115037387dc98ed1d9a4601fcfba0cc23896523c103f781120b2d8e7b0175
SHA512251fdee3f735ef73f22471b31784fa0bf7ac157d971a0673aedfa81fc48f7b33408e1792ae991b4f424a3f0c05cfa59bf3f59947053e67f9dd267a5b56cb04f7