Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe
-
Size
883KB
-
MD5
697f13b21eff3d1484b0d8ae273c7ce8
-
SHA1
fb1c09bd73b5c4386ff520ce135d046cd3ec5ef6
-
SHA256
37178840a8dd06a0f435acf1c7055c6c2b784dde98e269f8cc93abb690272607
-
SHA512
6224cc38e433d6f7643ace34ea3ca940bcc7eda69368b489ac3cdc6a5cc202d8734e266bdd59e11b218c5fd9c5d3215fd3524cfc2a01084052000878d60bcb5c
-
SSDEEP
24576:qKeyxTAJj7P+yWwnPTAUGVYA1TKNct7llOYi+C:qKeyRA0yznPTQVYAw+HC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1284 lnj.exe -
Loads dropped DLL 1 IoCs
pid Process 2072 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\olbav\lnj.exe 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1284 2072 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe 31 PID 2072 wrote to memory of 1284 2072 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe 31 PID 2072 wrote to memory of 1284 2072 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe 31 PID 2072 wrote to memory of 1284 2072 697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\697f13b21eff3d1484b0d8ae273c7ce8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\olbav\lnj.exe"C:\Program Files (x86)\olbav\lnj.exe"2⤵
- Executes dropped EXE
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
909KB
MD559cab5fac13cea1f8ac04d838a552674
SHA1ff3c42d43f6086ecbba09760233b68cbda82efd6
SHA256ce443264df1ad44e411825d6693196e4b0101e8447d49a48162eb2c1a3ae99d8
SHA5121ce753163068fe6d06041fd02ae2c91a125f85d984d3aa276aee332907acdf5980de1a90b306672a1abdd2dff8127e60cc645c958c2a8465db9835ad1f839baa