Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe
-
Size
33KB
-
MD5
7235a6cb8daf05e126accb0bb71b1745
-
SHA1
79f3234feb1af48fcec3c01c25e6298a1e14483a
-
SHA256
908095ef8efd3243e7233d7f33fe7b78f65a563ca43180a0826e8b6d4cc49ce6
-
SHA512
6840fb7018bfb89af2c26e99c5f65ac3a09cb275b152b23850a8b09a40310d81e19532dadbd16bfb04632611ae64000fdfcd6a12e9bebdf3b4baa41ab0480e52
-
SSDEEP
768:erPCBB3zaPmI9/oHW40OmV+rI1dQG4csxaKVTWbb:QPCBRaPt5oHWfq81dQG4jxaKVTk
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2692 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2152 wuaucldt.exe 2776 wuaucldt.exe -
Loads dropped DLL 4 IoCs
pid Process 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 2152 wuaucldt.exe 2152 wuaucldt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\windows\\system32\\wuaucldt.exe" wuaucldt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuaucldt = "c:\\users\\admin\\wuaucldt.exe" wuaucldt.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wuaucldt.exe 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\wuaucldt.exe wuaucldt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2776 set thread context of 2792 2776 wuaucldt.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuaucldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2152 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 31 PID 2164 wrote to memory of 2152 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 31 PID 2164 wrote to memory of 2152 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 31 PID 2164 wrote to memory of 2152 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 31 PID 2152 wrote to memory of 2776 2152 wuaucldt.exe 32 PID 2152 wrote to memory of 2776 2152 wuaucldt.exe 32 PID 2152 wrote to memory of 2776 2152 wuaucldt.exe 32 PID 2152 wrote to memory of 2776 2152 wuaucldt.exe 32 PID 2776 wrote to memory of 2792 2776 wuaucldt.exe 33 PID 2776 wrote to memory of 2792 2776 wuaucldt.exe 33 PID 2776 wrote to memory of 2792 2776 wuaucldt.exe 33 PID 2776 wrote to memory of 2792 2776 wuaucldt.exe 33 PID 2776 wrote to memory of 2792 2776 wuaucldt.exe 33 PID 2776 wrote to memory of 2792 2776 wuaucldt.exe 33 PID 2164 wrote to memory of 2692 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 34 PID 2164 wrote to memory of 2692 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 34 PID 2164 wrote to memory of 2692 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 34 PID 2164 wrote to memory of 2692 2164 7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe 34 PID 2152 wrote to memory of 1072 2152 wuaucldt.exe 36 PID 2152 wrote to memory of 1072 2152 wuaucldt.exe 36 PID 2152 wrote to memory of 1072 2152 wuaucldt.exe 36 PID 2152 wrote to memory of 1072 2152 wuaucldt.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7235a6cb8daf05e126accb0bb71b1745_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\windows\SysWOW64\wuaucldt.exec:\windows\system32\wuaucldt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\users\admin\wuaucldt.exec:\users\admin\wuaucldt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\windows\syswow64\wuaucldt.exe3⤵
- System Location Discovery: System Language Discovery
PID:1072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\users\admin\appdata\local\temp\7235A6~1.EXE2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD57235a6cb8daf05e126accb0bb71b1745
SHA179f3234feb1af48fcec3c01c25e6298a1e14483a
SHA256908095ef8efd3243e7233d7f33fe7b78f65a563ca43180a0826e8b6d4cc49ce6
SHA5126840fb7018bfb89af2c26e99c5f65ac3a09cb275b152b23850a8b09a40310d81e19532dadbd16bfb04632611ae64000fdfcd6a12e9bebdf3b4baa41ab0480e52