Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe
-
Size
733KB
-
MD5
6722feceb034ff2bb047c8b53012d35d
-
SHA1
efee3eecf3fc68a54190a2e7036518392ce1fb43
-
SHA256
c7ab3c8c9296c23513f160e86b25efb3978c5fe39f8b61b37d25acb9075a9bbe
-
SHA512
3ac3c6de3297a1c528c636e49e8d2cf7f9483f19044c535d79b7eb6d729cbe54cfdc42905661dbd8ff5863574c03cce6b153b5eca453f2f07fe6986a5df1546c
-
SSDEEP
12288:13Fpj4rBRLukn+zKg2oOR2OQl5XAdmxQDgGeItGBV07XpWZhASRXHYnrmY:1VpUFRUgoOwOY5XAqQlFtWVAqRXHYrmY
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2640 netsh.exe 2732 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1144 wrote to memory of 2404 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 29 PID 1144 wrote to memory of 2404 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 29 PID 1144 wrote to memory of 2404 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 29 PID 1144 wrote to memory of 2404 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 29 PID 1144 wrote to memory of 2452 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 31 PID 1144 wrote to memory of 2452 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 31 PID 1144 wrote to memory of 2452 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 31 PID 1144 wrote to memory of 2452 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 31 PID 1144 wrote to memory of 2196 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 33 PID 1144 wrote to memory of 2196 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 33 PID 1144 wrote to memory of 2196 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 33 PID 1144 wrote to memory of 2196 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 33 PID 2196 wrote to memory of 2640 2196 cmd.exe 35 PID 2196 wrote to memory of 2640 2196 cmd.exe 35 PID 2196 wrote to memory of 2640 2196 cmd.exe 35 PID 2196 wrote to memory of 2640 2196 cmd.exe 35 PID 1144 wrote to memory of 2752 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 36 PID 1144 wrote to memory of 2752 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 36 PID 1144 wrote to memory of 2752 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 36 PID 1144 wrote to memory of 2752 1144 6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe 36 PID 2752 wrote to memory of 2732 2752 cmd.exe 38 PID 2752 wrote to memory of 2732 2752 cmd.exe 38 PID 2752 wrote to memory of 2732 2752 cmd.exe 38 PID 2752 wrote to memory of 2732 2752 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6722feceb034ff2bb047c8b53012d35d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"2⤵PID:2404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵PID:2452
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2640
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE2⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2732
-
-