Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe
-
Size
34KB
-
MD5
6fe006259294449ea5effbe6f4f472d9
-
SHA1
398f3f61b77e0400ddb0f596291727ac9be7e490
-
SHA256
96cf63e06797a19b5180b2fd6a5dae54f61141aa7279b6b05047761133c1b8c8
-
SHA512
a5d4e299bd42c76dc64faac22cdc17682e9452582df2eb9ed441f5470ba9571ab8beb4c63e01378949506046be1df58a0945b2d617df24ffc4b8fb7eff1ce9f4
-
SSDEEP
768:kJG9mSndWAIDEziK5su1rdABqFYz4j8ORhoob:gGwSnd3zL57fFYyRGy
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2336 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2680 wuaucldt.exe 3032 wuaucldt.exe -
Loads dropped DLL 4 IoCs
pid Process 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 2680 wuaucldt.exe 2680 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wuaucldt.exe 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3032 set thread context of 2668 3032 wuaucldt.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2680 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2680 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2680 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2680 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 30 PID 2680 wrote to memory of 3032 2680 wuaucldt.exe 31 PID 2680 wrote to memory of 3032 2680 wuaucldt.exe 31 PID 2680 wrote to memory of 3032 2680 wuaucldt.exe 31 PID 2680 wrote to memory of 3032 2680 wuaucldt.exe 31 PID 3032 wrote to memory of 2668 3032 wuaucldt.exe 32 PID 3032 wrote to memory of 2668 3032 wuaucldt.exe 32 PID 3032 wrote to memory of 2668 3032 wuaucldt.exe 32 PID 3032 wrote to memory of 2668 3032 wuaucldt.exe 32 PID 3032 wrote to memory of 2668 3032 wuaucldt.exe 32 PID 3032 wrote to memory of 2668 3032 wuaucldt.exe 32 PID 2624 wrote to memory of 2336 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 33 PID 2624 wrote to memory of 2336 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 33 PID 2624 wrote to memory of 2336 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 33 PID 2624 wrote to memory of 2336 2624 6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe 33 PID 2680 wrote to memory of 1236 2680 wuaucldt.exe 35 PID 2680 wrote to memory of 1236 2680 wuaucldt.exe 35 PID 2680 wrote to memory of 1236 2680 wuaucldt.exe 35 PID 2680 wrote to memory of 1236 2680 wuaucldt.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fe006259294449ea5effbe6f4f472d9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵
- System Location Discovery: System Language Discovery
PID:1236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\6FE006~1.EXE2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD56fe006259294449ea5effbe6f4f472d9
SHA1398f3f61b77e0400ddb0f596291727ac9be7e490
SHA25696cf63e06797a19b5180b2fd6a5dae54f61141aa7279b6b05047761133c1b8c8
SHA512a5d4e299bd42c76dc64faac22cdc17682e9452582df2eb9ed441f5470ba9571ab8beb4c63e01378949506046be1df58a0945b2d617df24ffc4b8fb7eff1ce9f4