Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe
-
Size
22KB
-
MD5
7073938a8e46f5b460c7108bb4d332ba
-
SHA1
b8aac7cd90a0dd357edeb8a1df7e3b3a85d095b6
-
SHA256
c8e010b23b7ab3f5b2ad045f688fb8ca71e9d31a7a14570953487bf3aa4811dc
-
SHA512
89f7265e6d86388e09abe5ec1e4f9efab2f29042e5951d0bd0ecc6b12017fcca6ce86066f123c288081565ae2e7222cab2dddf7f777bac6e37569359c6fe986b
-
SSDEEP
384:htRDQOeQwzyl5Ut+PltYHPyBLckk/6J34w+o:fRMOgyOu8WE/6J3P
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2068 uamovie.exe -
Loads dropped DLL 2 IoCs
pid Process 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\uamovie = "uamovie /u /p {F6515879-1FE9-11D0-BF1E-0000E8D0D146<" 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\uamovie.exe 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uamovie.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe 2068 uamovie.exe 2068 uamovie.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2068 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe 31 PID 1660 wrote to memory of 2068 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe 31 PID 1660 wrote to memory of 2068 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe 31 PID 1660 wrote to memory of 2068 1660 7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7073938a8e46f5b460c7108bb4d332ba_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\uamovie.exeuamovie 284739247347923284732⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5c99dc4d9f9d97fc294aee1fcff64e337
SHA1b2cf1230cb6db309eec9683005c5d06b6f627ec7
SHA256c8c3c77b57b9b058a6c60b57ffd0d7c960da0edf4a948cba05049309cf02fcee
SHA512bb08ec3ac09e842d7730fb02b37d989b88ead6398377cf5883a9e996329a89f572c43925349ded7a2a56f92f21fd2d30dfe23d56b488594c603025a8099636a9