Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe
-
Size
2.3MB
-
MD5
81cb634c12b3bcf57c0790e06a98fbbf
-
SHA1
9faddfc0587e130a4596f03bbfdb1cd440a1ade2
-
SHA256
fc38cd08761aa9d02b261224761029963c339ed3461cfca2797a06c1a23aba82
-
SHA512
c4b33cacca61327ce6f3b4293bf6f603884180831e14e879b79bff8bf158a65c6e4f8d2b695347013e0a46ca9e0e795d874d47a7f1efad4a9b3c45309cf7c585
-
SSDEEP
49152:jGYZNrQz3sviOdqtqezJTu8RstjdzbUxZaDuCcFlrsQlTFcRQi0jE:aONrIeiOdqtqA9+tuxEyCYlrzxcRQxjE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2788 is-LL1HA.tmp -
Loads dropped DLL 3 IoCs
pid Process 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 2788 is-LL1HA.tmp 2788 is-LL1HA.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-LL1HA.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2788 is-LL1HA.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2788 2316 81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\is-2J406.tmp\is-LL1HA.tmp"C:\Users\Admin\AppData\Local\Temp\is-2J406.tmp\is-LL1HA.tmp" /SL4 $400E2 "C:\Users\Admin\AppData\Local\Temp\81cb634c12b3bcf57c0790e06a98fbbf_JaffaCakes118.exe" 2200276 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652KB
MD5674250e475a85b68ddd1dcc87f1eb228
SHA148a442d128d57006c6085afda061b02b175ca1f8
SHA2562489b766a4598a6d5027211072f8e2efb4ca98fb5f5d5cc267fe52ab490437e0
SHA512ec068a56e6084ec835272d90e67146ede65b0acaa8c3ce73bca21f2d8e6f4627a3fe87da0f340a82d9b01cc7def8dd6cc2c95ba911dcefeb312c19f189a510f9
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3