Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 16:07
Behavioral task
behavioral1
Sample
6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe
-
Size
784KB
-
MD5
6842bbf2dc32dea2213de2dbf03f0e44
-
SHA1
e981d2935f0b20f9078b986ca03f3f0e9df8ac60
-
SHA256
de4c8fe30c4fc904f2b7f50ccf7092783e6056453eb43b2f905c9b5b50062e42
-
SHA512
0b9c9c47ee4a5a6b028a0e6609103e0fe47e6c6b8f627613a2c88795b675bc08a47cb53f8b42c15f3ba867bd851ec5a46b8eb13f2853356e6c50e056d5a377b6
-
SSDEEP
12288:HnEyrrDlSpkXeoh9skBAzIY83fRgQaqNjm1bFHq6qBS8N:/DoGpsSaIH3fNLNCFHDqcI
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2488-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2488-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2368-18-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2368-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2368-33-0x0000000002FD0000-0x0000000003163000-memory.dmp xmrig behavioral1/memory/2368-32-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/2368-22-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2488-35-0x0000000003250000-0x0000000003562000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2368 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2368 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2488-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000900000001227c-15.dat upx behavioral1/memory/2488-16-0x0000000003250000-0x0000000003562000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe 2368 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2368 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2368 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2368 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe 30 PID 2488 wrote to memory of 2368 2488 6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\6842bbf2dc32dea2213de2dbf03f0e44_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD59c58a1f75b000078ab67e8f4905820ca
SHA1f5c063bde49a416fd423c11950997e175a019a3a
SHA256f426fcdb05f15691194ac549262fdf2693f3ab0b5b8dada0bf673d2cb7845583
SHA51220f7327b9fcd633826aa8500704c4e49d4d2a524b34ef1189cac0d2113aab707f4ce9a55937844ca524afb98381bb3e7bd9fb630a428c97c9dce1a1ff2c7dedd