Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe
-
Size
34KB
-
MD5
5bf8f5142652c646b79576154cad4d67
-
SHA1
c90e00ab504ee43a4be500af81c5e85f79f04be4
-
SHA256
2f943353596980405854bbc3ca181529eacba714f794bfbaef9ef0243237792c
-
SHA512
403a5af0c12281f45e5404f06fb5999950fce0674ecbe57ef7d012c0362c8540d88dcb2329eb822bde87455e0ec99a5bb3a07f7e689fed8a186719c823559cf8
-
SSDEEP
768:1flivXrVKpVhKvtxwYHwVFoeAQZmucwU:JlqrVKprVuQZ
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2856 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2372 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe 2372 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\1ee9e9e4\jusched.exe 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe File created C:\Program Files (x86)\1ee9e9e4\1ee9e9e4 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe 2856 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2856 2372 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2856 2372 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2856 2372 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2856 2372 5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bf8f5142652c646b79576154cad4d67_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\1ee9e9e4\jusched.exe"C:\Program Files (x86)\1ee9e9e4\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
34KB
MD5eef96147fc7170b7f00e674f6426615c
SHA11fb9ba74dcc97ff0a5b00c1108fe8b733773ed03
SHA2568562cdf02f85848ad84e20e27f4042239069f4f12d0175bca49e1bcb34f563ec
SHA512e1841c115cc41569630d26ddc0852d419ee695565b8c85e654e9546cf9d70691a44799993dc141f60432944068641ff6822604064db77c342225e08d2911c03a