Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe
-
Size
79KB
-
MD5
5b6f56ac517d828c4f662f8e850d1193
-
SHA1
c64ab095a52fd600eaf0c004036244c6b8fb6a73
-
SHA256
6f101fc0fd82ece21d891db31204d175e78ee762590ceb4260a9371a9b7a523b
-
SHA512
f3e45ee12363cbadb2af2ba4d525f061d916b65b7768e88a578671ae0860af5a0f9aac0c8623e3f64a40d3fafc29162b8a3a1e0c9cafb544a003a434faf0e71d
-
SSDEEP
1536:ggR9HrBru+F7Ff8wqZMqtLMOAszjgGKN31ClvntqOhruom7NgHUT8c60psj:ggR9LBrnFvqZMq1kulqUuojiI0pA
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2104 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3024 WinDebug32.exe -
Loads dropped DLL 2 IoCs
pid Process 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\WinDebug32.exe 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinDebug32.exe 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinDebug32.exe WinDebug32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3024 WinDebug32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2676 wrote to memory of 3024 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 30 PID 2676 wrote to memory of 3024 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 30 PID 2676 wrote to memory of 3024 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 30 PID 2676 wrote to memory of 3024 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 30 PID 2676 wrote to memory of 2104 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 31 PID 2676 wrote to memory of 2104 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 31 PID 2676 wrote to memory of 2104 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 31 PID 2676 wrote to memory of 2104 2676 5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe 31 PID 3024 wrote to memory of 2352 3024 WinDebug32.exe 32 PID 3024 wrote to memory of 2352 3024 WinDebug32.exe 32 PID 3024 wrote to memory of 2352 3024 WinDebug32.exe 32 PID 3024 wrote to memory of 2352 3024 WinDebug32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b6f56ac517d828c4f662f8e850d1193_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\WinDebug32.exe"C:\Windows\system32\WinDebug32.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\WINDEB~1.EXE > nul3⤵PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\5B6F56~1.EXE > nul2⤵
- Deletes itself
PID:2104
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD55b6f56ac517d828c4f662f8e850d1193
SHA1c64ab095a52fd600eaf0c004036244c6b8fb6a73
SHA2566f101fc0fd82ece21d891db31204d175e78ee762590ceb4260a9371a9b7a523b
SHA512f3e45ee12363cbadb2af2ba4d525f061d916b65b7768e88a578671ae0860af5a0f9aac0c8623e3f64a40d3fafc29162b8a3a1e0c9cafb544a003a434faf0e71d