Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe
-
Size
61KB
-
MD5
48e20220d52a21d9b5587f20e5ea2922
-
SHA1
3599132f5102a199e872abaa917a3f0986dcb846
-
SHA256
4b992fd80ee8dd12549462c198b14a874fdedf35395cf1eaa29982e86de115a0
-
SHA512
fe5dd4c1df21429d446576f8f8659a12d998c3ee8afb43a4ab43f3413e98c706efe008ef1ad4fd2891e557be1c4a6f56fa7cc8c636dbbe5c2999446573fcf8a4
-
SSDEEP
1536:1OPhlosUoAarDX1JJvZg+BwXUp74XW+x+G:1OPlfJJe+WA2zx+G
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000016ec4-3.dat acprotect -
Loads dropped DLL 3 IoCs
pid Process 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x0008000000016ec4-3.dat upx behavioral1/memory/2120-5-0x00000000003D0000-0x00000000003E2000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\winrar\ico\taobao.tbico 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbico 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbico\ = "icofile" 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nfo 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nfo\ = "VBSFile" 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31 PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31 PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31 PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31 PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31 PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31 PID 2120 wrote to memory of 2804 2120 48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\48e20220d52a21d9b5587f20e5ea2922_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\wscript.exewscript.exe /nologo "C:\Users\Admin\AppData\Local\Temp\6622.nfo"2⤵PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
21KB
MD5ab467b8dfaa660a0f0e5b26e28af5735
SHA1596abd2c31eaff3479edf2069db1c155b59ce74d
SHA256db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
SHA5127d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301