Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe
Resource
win10v2004-20240730-en
Errors
General
-
Target
81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe
-
Size
55KB
-
MD5
81ce02ae55ada2a82d3312ef42d81ed1
-
SHA1
8cb85ef44f3578126245ce8b7ed5eb0aca022faa
-
SHA256
b49aa4b947333397cb9fe9ac4752437b2ff87bceff7add7494feb7074f6e0f9d
-
SHA512
d741d1d1eb356e38c707854651aaa55b3a7a2a8cc1682ba31d2ca74964f0e4ba8d0dd5a2177548251b85063bca7c76a739a044e9d1d806b955e5bc250d25dea1
-
SSDEEP
768:De1fm4vVLnlcDOZ80sprqSw/ZHOBFoSEWbDI41M8ujkuuqkcr4:De7xlcDH0YWSw/ZHOBFCoDIkLA4
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\1049429571 = "C:\\Users\\Admin\\1049429571.exe" reg.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cMd.exE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2476 81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1916 2476 81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1916 2476 81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1916 2476 81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe 31 PID 2476 wrote to memory of 1916 2476 81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe 31 PID 1916 wrote to memory of 2448 1916 cMd.exE 33 PID 1916 wrote to memory of 2448 1916 cMd.exE 33 PID 1916 wrote to memory of 2448 1916 cMd.exE 33 PID 1916 wrote to memory of 2448 1916 cMd.exE 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81ce02ae55ada2a82d3312ef42d81ed1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cMd.exEcMd.exE /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1049429571 /t REG_SZ /d "%userprofile%\1049429571.exe" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1049429571 /t REG_SZ /d "C:\Users\Admin\1049429571.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2448
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵PID:2820
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\81CE02~1.EXE > nul2⤵PID:2044
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2780
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2604