Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe
-
Size
102KB
-
MD5
432a0863bfcb4e61e7e2624e754b5ef5
-
SHA1
570f04ab9ccf76b11f739a5cc27e7fda06134415
-
SHA256
3eaf4024b61b2f62bed2389971133657e87fd53523f1c18988044267f3ab5bda
-
SHA512
949f3379282a8802f41b60401b98db1fc4d688f3bf7b39e9f2fe94c17d7699ab8658fa77de8dd74f1863855549ff3d7fdb3e8a359d433a4fd8a81f6158fd2a45
-
SSDEEP
3072:ZkeiMlPzBMEjV99NO5ycFGaWKiJyGR4ld8:/if0OQkE4l
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\adobe updates = "C:\\Windows\\system32\\server.exe" 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\adobe updates = "C:\\Windows\\system32\\server.exe" server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1940 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1940 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe 2544 server.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2544 1940 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe 30 PID 1940 wrote to memory of 2544 1940 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe 30 PID 1940 wrote to memory of 2544 1940 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe 30 PID 1940 wrote to memory of 2544 1940 432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\432a0863bfcb4e61e7e2624e754b5ef5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\server.exe"C:\Windows\system32\server.exe" ONCE2⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2544
-