Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe
-
Size
221KB
-
MD5
6fb089ddae3eaeca1f4e505a80c0bc89
-
SHA1
0880e476574448e6b10e385fbbcbe536cfafabfd
-
SHA256
d0c111ef281e91a0ff27cc1ef0568b3bf2acd4094fd36c88df29ca5672266526
-
SHA512
62f62dd14ae7e10790374e46e84f9b6b35d7dd38766b174dec39686773f7391018c7b14a7643b80282a2bfe01bcaaee23b60413cf1588f2ea6dabfb6c61118d6
-
SSDEEP
1536:7IdcFLZp0dsrYgdRAgH0/m38wIJVOy2JDVhCK8PTSuBlXMfayRg:7IdcFLEdskgrt05bnwhVh6PTPlcfa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2520 idemoodp0cetka.exe 2872 idemoodp0cetka.exe -
Loads dropped DLL 3 IoCs
pid Process 2104 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 2104 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 2520 idemoodp0cetka.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS Service Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\idemoodp0cetka.exe" 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1856 set thread context of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 2520 set thread context of 2872 2520 idemoodp0cetka.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idemoodp0cetka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idemoodp0cetka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 2520 idemoodp0cetka.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 1856 wrote to memory of 2104 1856 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2520 2104 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 32 PID 2104 wrote to memory of 2520 2104 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 32 PID 2104 wrote to memory of 2520 2104 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 32 PID 2104 wrote to memory of 2520 2104 6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe 32 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33 PID 2520 wrote to memory of 2872 2520 idemoodp0cetka.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fb089ddae3eaeca1f4e505a80c0bc89_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2872
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD56fb089ddae3eaeca1f4e505a80c0bc89
SHA10880e476574448e6b10e385fbbcbe536cfafabfd
SHA256d0c111ef281e91a0ff27cc1ef0568b3bf2acd4094fd36c88df29ca5672266526
SHA51262f62dd14ae7e10790374e46e84f9b6b35d7dd38766b174dec39686773f7391018c7b14a7643b80282a2bfe01bcaaee23b60413cf1588f2ea6dabfb6c61118d6