Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
3f9b3966227a581c4fe8aaeca62f2fb3
-
SHA1
7ee7554b56524cf5ac70d224bc84e28a834746d9
-
SHA256
d007b17a5014990fca0bfbb32f4250538046ad6fcee98229334eec54de642d8f
-
SHA512
30345c04dfcc03a34ff125519d5b92c2acde1af096d3fda76c96fb2b09e703f2bf9edb7c1257102424fb3b05cc079d91779452559477fd9f6f07e4722c8f703d
-
SSDEEP
24576:fp0jZRWmsRHzvDlZ9mUP209jbTUDGHcVKf5pOWVGCMWOruYZE38V1sp9twmDlzBM:fp9HzblKUP2Ry5OWLuu7Q8vZKxr
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2296 lol.exe 2788 lol.tmp 2808 szagram.exe -
Loads dropped DLL 6 IoCs
pid Process 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 2296 lol.exe 2788 lol.tmp 2788 lol.tmp 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDefend = "C:\\Windows\\Wolcipo.exe" szagram.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Zaqer\Mopeloi\szagram.exe 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe File opened for modification C:\Program Files\Zaqer\Mopeloi\ferggdfgdfgdgsfg.btj 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe File created C:\Program Files\Zaqer\Mopeloi\lol.exe 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe File created C:\Program Files\Zaqer\Mopeloi\ferggdfgdfgdgsfg.btj 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Wolcipo.exe szagram.exe File opened for modification C:\Windows\Wolcipo.exe szagram.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2788 lol.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2296 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2296 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2296 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2296 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 29 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 2296 wrote to memory of 2788 2296 lol.exe 30 PID 3044 wrote to memory of 2808 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 31 PID 3044 wrote to memory of 2808 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 31 PID 3044 wrote to memory of 2808 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 31 PID 3044 wrote to memory of 2808 3044 3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f9b3966227a581c4fe8aaeca62f2fb3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files\Zaqer\Mopeloi\lol.exe"C:\Program Files\Zaqer\Mopeloi\lol.exe" NULL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\is-SLF1B.tmp\lol.tmp"C:\Users\Admin\AppData\Local\Temp\is-SLF1B.tmp\lol.tmp" /SL5="$70150,500374,64512,C:\Program Files\Zaqer\Mopeloi\lol.exe" NULL3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2788
-
-
-
C:\Program Files\Zaqer\Mopeloi\szagram.exe"C:\Program Files\Zaqer\Mopeloi\szagram.exe" NULL2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600KB
MD5a310b1a0949342b78f4e1a4fd3d5aeb9
SHA184e6c021c24f090a8e69eca40344a5dca2571061
SHA25619e8b88416e312ebb468e227f0b7047a8462dea03c577d41c8322169be297b1b
SHA5122682b0cef5f44da36cd05f3425a4df13e48d8c8a09e085ea060a6b3ffb88c7a8803b862ef71e44e927af5d2f4241d5c18fb73fdcd4bf213922280abc34a8f2ee
-
Filesize
734KB
MD5750bdb5da81f06f1ee0ed7d135e18b4d
SHA106464258ebb1b2ba2b7201f2383ef96a85670ef9
SHA2567c1726a58a5971785da951c692a9640beac74c3420ef6901b704911168967821
SHA512948ab46ca01a0a40a11924a88d754c2ee48c8c305b780adbeb0f086fc8bbf38d36ffcdeaffa9c6fb33e29b3e416711559b8e660ef92b5fef56bcf1c3ae2137bd
-
Filesize
604KB
MD520b6de21a009223bc39b5ad145604467
SHA1d5e1de75c3e63b7db1dd6b618d53f44e1fea01b3
SHA256cad25bdc4882b3208a0da6ea1fc9ea8ced9d16f49cf8d050eaa108fbc8ecf03b
SHA512d85cecdd403958dbbcc6426f2341b24c31f898a704cba78ab5cd313aa16679910b18ffe45e181f5f0f4dabe3f1e789e34cd1929bfef5fe087e2d70b5721f980d
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
688KB
MD56bf79ed656e55970b65062e23dfbf4ec
SHA122e26780d2f91c690bb8a887763073053089dad1
SHA2566634675be98e8748ec7e6c9578f54304e2741ed5d648c74bad5930a449183cd8
SHA5129c93dea2b95d35a39e5d85590c82a8daa525a5f4fa23b2d4db936b527da6293526aa948cb54752baf84293fbf1eacd15798dbe587472509c5a64ade1cf9af4a4