Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
63a9478357f9de4492515183b5a8aff0_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63a9478357f9de4492515183b5a8aff0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
63a9478357f9de4492515183b5a8aff0_JaffaCakes118.dll
-
Size
32KB
-
MD5
63a9478357f9de4492515183b5a8aff0
-
SHA1
1cdcb024c7acba66a572ea040568752024c6f536
-
SHA256
c95c162e0265c03ea623dadc3534a783c93f42e7bb03b72f9cbf18098d7d7c46
-
SHA512
d8c9a9d2e309e69d1f7b700c723363ec3cd6c702980f5a37f68d832a0412309a1741eb33e897bf4ce96edb729e35fc46d5e017c70a416eaabc53a561764f13e0
-
SSDEEP
384:GaXSbS8RQP1RxVkosHVmWebRJZZPzAT0DyE7Q1Ww7//ChLu3/Y:GaXMssKbRJZ9zs0yQQ1W8/6hLu3/
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "regedit.exe /s \"%1\"" rundll32.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2628 regedit.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 836 rundll32.exe 836 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 2904 wrote to memory of 836 2904 rundll32.exe 29 PID 836 wrote to memory of 2148 836 rundll32.exe 30 PID 836 wrote to memory of 2148 836 rundll32.exe 30 PID 836 wrote to memory of 2148 836 rundll32.exe 30 PID 836 wrote to memory of 2148 836 rundll32.exe 30 PID 2148 wrote to memory of 2628 2148 cmd.exe 32 PID 2148 wrote to memory of 2628 2148 cmd.exe 32 PID 2148 wrote to memory of 2628 2148 cmd.exe 32 PID 2148 wrote to memory of 2628 2148 cmd.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63a9478357f9de4492515183b5a8aff0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63a9478357f9de4492515183b5a8aff0_JaffaCakes118.dll,#12⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a.reg3⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\regedit.exe"regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\a.reg"4⤵
- Runs .reg file with regedit
PID:2628
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD5f3dbe232e05c7524d83f53e5b1d74903
SHA173f9f4252efc4ccb54aa7a000ababf88fcd5934c
SHA25624228c7cc91bb36420590e9a46a668d5a336578c64c3db507559c5c24ab69782
SHA512873a02dcf63f1fad1c1b508d8f330fde5ac5fc36c57b2e8ab18b632facd1f6f9c93335e7564cfdb12dc05c6b1317666faebb6a440bd0d968892a31a7d48764e9