Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe
-
Size
56KB
-
MD5
67d9cf75307699133cd115c27cddd7ba
-
SHA1
4a0fec707fb414cf95b43be6d4f4c7ab340d40ed
-
SHA256
14261a8b4435b260a22d3f3dba34bc4eeeda7b024d50797e76c952d1d3687a10
-
SHA512
94399018ca57542235522033eaa14973cade769784a06461c3fff6702eaf13aeb9b6d156a28e295b1415796b0293c3e547c3a918cec04f53bd0b0b7f6a8352ae
-
SSDEEP
768:dqJ508ZIAA/gNqh+iC1sgUfOW+7Sj6Zz6ZjkfZa8g0y:2IZ/gNqhJbOWIu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2732 agetlksyiel.exe -
Loads dropped DLL 2 IoCs
pid Process 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\agetlksyiel.exe 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\psapi.lib agetlksyiel.exe File created C:\Windows\SysWOW64\psapi.lib agetlksyiel.exe File opened for modification C:\Windows\SysWOW64\psapi.lib 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe File created C:\Windows\SysWOW64\psapi.lib 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe File created C:\Windows\SysWOW64\agetlksyiel.exe 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 2732 agetlksyiel.exe 2732 agetlksyiel.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2732 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2732 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2732 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2732 2708 67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\67d9cf75307699133cd115c27cddd7ba_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\agetlksyiel.exe"C:\Windows\system32\agetlksyiel.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5a5b1b1f7c2c51ff400d93ae63f484d96
SHA15f038003bf8851254ba577db5d8dfd69c1085c33
SHA25635b1d2d2bc5c531d49aa3550de5c19bd5f4ebe79c594c6f5000d6de28b2621bf
SHA51290c2145b39611bd1406c513dff16366a51e86e8831c34ab15f650e6620a75533e800db056dda2e7e176fac8b20cd0be76bc1725b45930b31595d4aac00da4eec
-
Filesize
56KB
MD567d9cf75307699133cd115c27cddd7ba
SHA14a0fec707fb414cf95b43be6d4f4c7ab340d40ed
SHA25614261a8b4435b260a22d3f3dba34bc4eeeda7b024d50797e76c952d1d3687a10
SHA51294399018ca57542235522033eaa14973cade769784a06461c3fff6702eaf13aeb9b6d156a28e295b1415796b0293c3e547c3a918cec04f53bd0b0b7f6a8352ae