Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe
-
Size
252KB
-
MD5
72f5de21bef8e2caaf636074c3e72720
-
SHA1
bae0d8fb563355fbdc818f9d0f789ee10219e584
-
SHA256
706472cbbdef4466daeb26f516ae07c24579394e039766f93bf7ab1bfe116e08
-
SHA512
78045460e5d537d600f937fde73f9685578cf0dd087a86cf61127f19e24737b6054226d162e4eeb54eaa6fd23956c40ad2042de98bf71ac56b360d0be3c9d75e
-
SSDEEP
6144:LW57hEh0jrC9DzzsDeEssXPBQA6Onn42VW0dkm4o:L47scokPPBQnOn4j0km4o
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2008 N0ise.exe 2736 audiohd.exe 2828 WUDHost.exe -
Loads dropped DLL 1 IoCs
pid Process 2296 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\audiohd.exe\"" N0ise.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows-Network Component = "\"C:\\Windows\\system32\\WUDHost.exe\"" N0ise.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\WUDHost.exe N0ise.exe File created C:\Windows\system32\WUDHost.exe N0ise.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 audiohd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier audiohd.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WUDHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WUDHost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 N0ise.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier N0ise.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2008 N0ise.exe 2008 N0ise.exe 2008 N0ise.exe 2008 N0ise.exe 2008 N0ise.exe 2008 N0ise.exe 2008 N0ise.exe 2008 N0ise.exe 2736 audiohd.exe 2736 audiohd.exe 2736 audiohd.exe 2736 audiohd.exe 2736 audiohd.exe 2736 audiohd.exe 2736 audiohd.exe 2736 audiohd.exe 2828 WUDHost.exe 2828 WUDHost.exe 2828 WUDHost.exe 2828 WUDHost.exe 2828 WUDHost.exe 2828 WUDHost.exe 2828 WUDHost.exe 2828 WUDHost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2008 N0ise.exe Token: SeDebugPrivilege 2736 audiohd.exe Token: SeDebugPrivilege 2828 WUDHost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2008 2296 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2008 2296 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2008 2296 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2008 2296 72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe 30 PID 2008 wrote to memory of 2736 2008 N0ise.exe 33 PID 2008 wrote to memory of 2736 2008 N0ise.exe 33 PID 2008 wrote to memory of 2736 2008 N0ise.exe 33 PID 2008 wrote to memory of 2828 2008 N0ise.exe 34 PID 2008 wrote to memory of 2828 2008 N0ise.exe 34 PID 2008 wrote to memory of 2828 2008 N0ise.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72f5de21bef8e2caaf636074c3e72720_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\N0ise.exe"C:\Users\Admin\AppData\Local\Temp\N0ise.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Roaming\audiohd.exe"C:\Users\Admin\AppData\Roaming\audiohd.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\system32\WUDHost.exe"C:\Windows\system32\WUDHost.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5289e05dd750815644e1584a823bdd812
SHA1eeca3545db3a0d884f216661044fd9db915690d1
SHA2567bb7ef8e0ea623a83d5d3dd952b56b7dc04dbfca03bad6eba62afe09fbeb0552
SHA512e6fb5d7b347337b3f1a1094b2dd8256c699d3a4f4fa38557e2857f5b2e10e4ee24232e79bad71a6d6c8ce2ff670e4c2bb55815757f499c27b023bfab8ec5f3d3