Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
5a7c5387f107ee6eea7c7debcd9d449f
-
SHA1
392c1eed3a6b8e2209d975efc1fab5909db5adc2
-
SHA256
1edd5a31230594d44488fe0a471031f3bf3cf8c5527dc60025a957b67f8a4b90
-
SHA512
e1ac70690da971039a9aa319134aa6a40ef7d551872e38cd9487e921b0612eff1cb337fde875285ed3447c67e7a78fe4ac37bf39e073d3eec2285ebc112b49d1
-
SSDEEP
24576:B2uFhCwUuqDluBMfEhJX3z5mKhwbLeoMX0j:dhxqDosEL3F/w+X2
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2696 smes.exe 2760 smes.exe 2876 smes.exe 2920 smes.exe -
Loads dropped DLL 14 IoCs
pid Process 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 1176 cmd.exe 1176 cmd.exe 2696 smes.exe 2696 smes.exe 1176 cmd.exe 1176 cmd.exe 2760 smes.exe 2760 smes.exe 2876 smes.exe 2876 smes.exe 2920 smes.exe 2920 smes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2696 smes.exe Token: SeDebugPrivilege 2760 smes.exe Token: SeDebugPrivilege 2876 smes.exe Token: 33 2876 smes.exe Token: SeIncBasePriorityPrivilege 2876 smes.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2920 smes.exe 2920 smes.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1176 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 3008 wrote to memory of 1708 3008 5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe 32 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2696 1176 cmd.exe 34 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 1176 wrote to memory of 2760 1176 cmd.exe 35 PID 2876 wrote to memory of 2920 2876 smes.exe 37 PID 2876 wrote to memory of 2920 2876 smes.exe 37 PID 2876 wrote to memory of 2920 2876 smes.exe 37 PID 2876 wrote to memory of 2920 2876 smes.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a7c5387f107ee6eea7c7debcd9d449f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\ProgramData\smes\smes.exesmes.exe -install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\ProgramData\smes\smes.exesmes.exe -start3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"2⤵PID:1708
-
-
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe -run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD5ffc3088dc68b14616fc334ce25f7c4ec
SHA183ea5e504ba582fd0db81371888b2d2d36012af8
SHA256f39e009b78bbca138cf7ca72023390afe0e9ab1980eb0e326e637186a1249872
SHA512b3c29e4513ba21d9588661eeffe029bdc5a2317cb3345cbe945f50df9688732d478e614e67a64f87d9cdf2c284eaeb9c497feef69ee71a621f4fc009bf1c09b4
-
Filesize
202B
MD5a89ec8ccabdf1800222ff3bc15cc16ed
SHA12956e50fe74d20211ad2dc277080a48f3c5d4596
SHA256f394017b5fba87ef60a2306b068c703a4d6edcc2a9a2451d7d75bce8b98f4cc9
SHA512f219735a171b3e5cd9a4f2032c4825706ebcc33de239bd68ae380150c2554cf4517908797181caee89bc2ec3dcbff826e7e2399dc00a03a3ba5ac5ae2f924922
-
Filesize
448B
MD5a560270edda8dfc34e77ac14fd8710d7
SHA1de4efbf0544aa0afb86ccee65d069d22e85347e7
SHA256c2cc11b37fa01193672103b0504ae79054561dfbc4149070e21a35d1814bb0b2
SHA512a09581672dc2f2a14f1c23fa252f085efc510d709c1de1d6cde018646c4609ca4a5470d95c05fa5ff2930adaa697c02711d4d0679ecf0f28c53874efc146e3f2
-
Filesize
546B
MD5be84dd0a15592fc5065cd9ef671e176d
SHA1dd38d76c4002e52b9cb0caacf15af10b1d4bfc4b
SHA2561f7dd1cc032aee3f408e2e19ff362493f9061aa51d89649db9376d41507d1ef6
SHA5121186a41e90b0225094840dd53501bd5d8af63a58bdaae532341ee7afa5881157d54b6586394b0dafbc66c82268d135979925bc5ef6f731661b6c23529dd0ed17
-
Filesize
425KB
MD5bf5dcfd9da0514334d41cbd80d2a9138
SHA1802f9e0b82edca56be08a33b2ba874b34c31f1e3
SHA256f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060
SHA512246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc
-
Filesize
433KB
MD545199dab51eeece95728abfe25e18f35
SHA159ab0fe25aa2adc253adbecba6862e7432df1c39
SHA256a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391
SHA512825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12
-
Filesize
44B
MD5704efba1aee1454561da552dda430498
SHA1d20fb96683f769eb9cef1b0a068bcba70aeab9c2
SHA25680b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c
SHA5127e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0
-
Filesize
135B
MD5cd94b0989238975ab163f88f02affb64
SHA19c1e0dbc9e685862c9db2464167a28cf5b873032
SHA256dcce0107e9ee75eaaeba7563e498627b04fce05e9a9738eac57f4a24dadc25a3
SHA5128c55bfdb4daf7f06d438a21a848a63044cc4fcba326824f591bd161f946afcc980d13adc3941c92fb5875b5ed7108cb1161eb93dcab30d298a755286cac37c05
-
Filesize
441KB
MD57851449473178f9782263d51bc5e3bbc
SHA1ad5148ee1bed2348b320c62c025d52fbcbb28799
SHA256c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4
SHA512b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49
-
Filesize
209KB
MD51fa47f5b173cee5ef9c3ee1bda0c321e
SHA160ee40236f960affb01d569a32e1b05888bb081a
SHA256b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64
SHA51201f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b