Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
44e3bd972337842562352af27a0789f2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44e3bd972337842562352af27a0789f2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44e3bd972337842562352af27a0789f2_JaffaCakes118.exe
-
Size
92KB
-
MD5
44e3bd972337842562352af27a0789f2
-
SHA1
920c7bb8b63ef1db2654398b31532157708774d3
-
SHA256
65d3a7c6a1e5be10b82d04551e32a6042caf800f262f49544a4b4771e5e3a989
-
SHA512
560d86cc12f55c313a145fb951d527dcb26477c7a45b485930e2168ca2da0e729974c286398e17e0cf1005556df42293fb422324205ba663436c55ff6f21ee62
-
SSDEEP
1536:hmPURyl7jCtfA6VuMVUOJnqQ5JgF7YEQmgo59ZODChKlRMPKlg2j9oH78:hQUR86tfA6VvVUop5CjI82DChKlyy2b8
Malware Config
Signatures
-
Loads dropped DLL 8 IoCs
pid Process 2188 rundll32.exe 2188 rundll32.exe 2188 rundll32.exe 2188 rundll32.exe 2804 rundll32.exe 2804 rundll32.exe 2804 rundll32.exe 2804 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qmadusefubemo = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\guxoxit.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2188 rundll32.exe 2188 rundll32.exe 2188 rundll32.exe 2188 rundll32.exe 2188 rundll32.exe 2188 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2188 2412 44e3bd972337842562352af27a0789f2_JaffaCakes118.exe 30 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32 PID 2188 wrote to memory of 2804 2188 rundll32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\44e3bd972337842562352af27a0789f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44e3bd972337842562352af27a0789f2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\guxoxit.dll",Startup2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\guxoxit.dll",iep3⤵
- Loads dropped DLL
PID:2804
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5ec1ee86206290cfba1f1d75befe2c87d
SHA1f3adcba6e33a3cc2b7b3f5848c89784d66f97106
SHA2569750af89a7e85500914ef34871f1f7bdb2fddacf3eb7031e5f71fd0c9a855a38
SHA512aa249f9038f7d99ea981b6b6f8cf7f10a6e1dfac64c844bfc184d458bbd6f42ea45cb403477ea62afe8c738c8923fa73509fc3cf2db9901026228f057631676b