Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
11s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Errors
General
-
Target
64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe
-
Size
43KB
-
MD5
64d4e3d136e8a1b8fbbacb2d3fd59979
-
SHA1
79c80a8668b4ce529563b561ff6778c9ab330e27
-
SHA256
2c357310491f6643a133870005248ef8ea4af1734358996e4edf882f17d39158
-
SHA512
fc56d85ea9dca0c115016468867978a4bece667400fdc70f7837f5cb2fbe776730921699c23a3c43f1aa67905713b44c3783cab144edd9b2eacd0152f99d0e15
-
SSDEEP
768:yyBnYLuyuF+C/0SYVHpgvfOpUiHf92ZSEGtpvsT51FwdC/pZPodEeEJ6Len:ycnYLuqcvY9KvGpRMZeQFwdinPydEJ66
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2896 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\551132085 = "C:\\Users\\Admin\\551132085.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe Token: SeShutdownPrivilege 2692 shutdown.exe Token: SeRemoteShutdownPrivilege 2692 shutdown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2544 wrote to memory of 3060 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 31 PID 2544 wrote to memory of 3060 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 31 PID 2544 wrote to memory of 3060 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 31 PID 2544 wrote to memory of 3060 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 31 PID 3060 wrote to memory of 2296 3060 cmd.exe 33 PID 3060 wrote to memory of 2296 3060 cmd.exe 33 PID 3060 wrote to memory of 2296 3060 cmd.exe 33 PID 3060 wrote to memory of 2296 3060 cmd.exe 33 PID 2544 wrote to memory of 2692 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2692 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2692 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2692 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 34 PID 2544 wrote to memory of 2896 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 36 PID 2544 wrote to memory of 2896 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 36 PID 2544 wrote to memory of 2896 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 36 PID 2544 wrote to memory of 2896 2544 64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64d4e3d136e8a1b8fbbacb2d3fd59979_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 551132085 /t REG_SZ /d "%userprofile%\551132085.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 551132085 /t REG_SZ /d "C:\Users\Admin\551132085.exe" /f3⤵
- Adds Run key to start application
PID:2296
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\64D4E3~1.EXE > nul2⤵
- Deletes itself
PID:2896
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2500
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2620