Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe
-
Size
208KB
-
MD5
741c4a946960cc072619ad57386f86d7
-
SHA1
edf31d72b79f9ce512e768c83cb3fd15f8933326
-
SHA256
9f5a3f423d4d791000b01a625198519c6bebb33e842eb1be0e6f3c46fa59e454
-
SHA512
b11213c2a16aa02974399b9b89dc806076e5c1fcd0b9c0e03429592f30f714854ced02f3be21a46d301af6441c43918a49bfdaa56114013a12825e1d3c36e908
-
SSDEEP
1536:/NSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwAfdvoWQO57:/Eo75OnPSI09qgmBBAGKSvwovoW9B
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2196 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2688 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe 2688 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\44b3adc4\jusched.exe 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe File created C:\Program Files (x86)\44b3adc4\44b3adc4 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2196 2688 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe 31 PID 2688 wrote to memory of 2196 2688 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe 31 PID 2688 wrote to memory of 2196 2688 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe 31 PID 2688 wrote to memory of 2196 2688 741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\741c4a946960cc072619ad57386f86d7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\44b3adc4\jusched.exe"C:\Program Files (x86)\44b3adc4\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD53330ebaaa7e9f4630f4ad4c156be59d8
SHA140375cf8e68671e0100e725de5cd5c6657b9f722
SHA2562c8451d5dca9e68ec3af7f318c5d874fbdfea9e89e7b5f9922b4dbd65f027e15
SHA512b7631f9685bac9f81aa6bf53afd839910773e108989bbb79ba39cafabbe6b6994ed2fde44911c9f7f24b45c9745d6e80cd9f01975bfb765561df4881f7dad696
-
Filesize
208KB
MD55f7b48845db460b31a76c01c583ba698
SHA124f77109fd1bf5893e05e3db4b6035a0ade4876a
SHA256cfe880a6a221b65539150f3e61820dbff4b841f6beaaa61f7e85d77642ca9cd7
SHA512513e090e0822c025ce892b2836ecff44b89e4ea9f899dc452a07361b2fa16907d3d7724f221d6b507613b33f2eea41f66c16272ba157295d2be65731c2958a59