Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 11:38
Static task
static1
Behavioral task
behavioral1
Sample
499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe
-
Size
24KB
-
MD5
499de033296b91bb87a8d7d043b929b0
-
SHA1
f0094815d31f8912f4aa582689696fda7c1e16d4
-
SHA256
331c0b59e82feb04a7c4fc326b5a49f53738aec7ff4158d74f338e122c1f40d9
-
SHA512
12119f23ba7b22f7710bff7896b8241ffcc88e165e2cfaa75cbd598175f47435367495117b40f52ec189ba7211bdf60066db7e88815c24ec557092a8a83484e3
-
SSDEEP
384:E3eVES+/xwGkRKJalM61qmTTMVF9/q5F0:bGS+ZfbJaO8qYoAK
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1540 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2276 NETSTAT.EXE 2012 ipconfig.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1540 tasklist.exe Token: SeDebugPrivilege 2276 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1512 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe 1512 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1512 wrote to memory of 804 1512 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe 30 PID 1512 wrote to memory of 804 1512 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe 30 PID 1512 wrote to memory of 804 1512 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe 30 PID 1512 wrote to memory of 804 1512 499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe 30 PID 804 wrote to memory of 2212 804 cmd.exe 32 PID 804 wrote to memory of 2212 804 cmd.exe 32 PID 804 wrote to memory of 2212 804 cmd.exe 32 PID 804 wrote to memory of 2212 804 cmd.exe 32 PID 804 wrote to memory of 2012 804 cmd.exe 33 PID 804 wrote to memory of 2012 804 cmd.exe 33 PID 804 wrote to memory of 2012 804 cmd.exe 33 PID 804 wrote to memory of 2012 804 cmd.exe 33 PID 804 wrote to memory of 1540 804 cmd.exe 34 PID 804 wrote to memory of 1540 804 cmd.exe 34 PID 804 wrote to memory of 1540 804 cmd.exe 34 PID 804 wrote to memory of 1540 804 cmd.exe 34 PID 804 wrote to memory of 3056 804 cmd.exe 36 PID 804 wrote to memory of 3056 804 cmd.exe 36 PID 804 wrote to memory of 3056 804 cmd.exe 36 PID 804 wrote to memory of 3056 804 cmd.exe 36 PID 3056 wrote to memory of 2896 3056 net.exe 37 PID 3056 wrote to memory of 2896 3056 net.exe 37 PID 3056 wrote to memory of 2896 3056 net.exe 37 PID 3056 wrote to memory of 2896 3056 net.exe 37 PID 804 wrote to memory of 2276 804 cmd.exe 38 PID 804 wrote to memory of 2276 804 cmd.exe 38 PID 804 wrote to memory of 2276 804 cmd.exe 38 PID 804 wrote to memory of 2276 804 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\499de033296b91bb87a8d7d043b929b0_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2212
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2012
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2896
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d04824b9b418941daf17871647147e35
SHA102b3b39897c14a3da5421edbc36f0a75666f7e5b
SHA256e97cad66ccac8941591a6a61a229c6c0bd6ef90665313c3d5920ec935e16efad
SHA512fbd6b312200d556eb399500ec1d61dca7b182b206871f323aa7c69a75e595d9b86e4bfa7df5386034d4c666ddd09272907bc380e3450b365322706364a7d60c2