Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe
-
Size
249KB
-
MD5
68b4d16afa046607a2c570cc073fd7c8
-
SHA1
2ed079c4dbb214adc744017569742800f2e07bce
-
SHA256
3123f0068ffb523853cd675a624dd1ad16283eeba21e5e0f64cb53ce90ce5ce3
-
SHA512
8aacba2537918a08fca9284e7a35139ea0d60afe25d0458d52f5eb699cd0574803f992740c0f7d1026f8fdc4ef21293e37aa41c9fe180309f720647b2897d48f
-
SSDEEP
6144:zs9+3ZM/Um1WaGQwdijdHc2MHQQaiSQTO5Sv/dIQQq:7UU5Wq72MwuSQS5WK
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2504 set thread context of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\sysinfos.txt vbc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2280 2136 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2136 vbc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2504 wrote to memory of 2136 2504 68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe 31 PID 2136 wrote to memory of 2280 2136 vbc.exe 32 PID 2136 wrote to memory of 2280 2136 vbc.exe 32 PID 2136 wrote to memory of 2280 2136 vbc.exe 32 PID 2136 wrote to memory of 2280 2136 vbc.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\68b4d16afa046607a2c570cc073fd7c8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1963⤵
- Program crash
PID:2280
-
-