Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
8597035774a77b998098b82661729452_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
8597035774a77b998098b82661729452_JaffaCakes118.exe
-
Size
321KB
-
MD5
8597035774a77b998098b82661729452
-
SHA1
301a4af9c332c88b5ea379bfc9fe838a1588ac18
-
SHA256
d55ca229311d74076961c93d2a3a65bb33b91be334ec3eff447efcb050cda53f
-
SHA512
9aba9c9afcac07b88beea26fe53f37211e0651c75bc0b32cfeda5ef1e659e7c78a75332053cda461d199a07e14a7378e92c2621c8e1d431b63f1b6be2e94f85e
-
SSDEEP
6144:WIu9F2aZQWTwBnOWZqqnnEgcUd8BPrDWrMuCDdIhXLhHP0Xk:29FlwlO0RnnEhNPDTDcLhEk
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2364-2-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2364-42-0x0000000000400000-0x0000000000484000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8597035774a77b998098b82661729452_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe Token: SeDebugPrivilege 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1232 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 21 PID 2364 wrote to memory of 380 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 3 PID 2364 wrote to memory of 432 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 5 PID 2364 wrote to memory of 488 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 7 PID 2364 wrote to memory of 496 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 8 PID 2364 wrote to memory of 588 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 9 PID 2364 wrote to memory of 668 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 10 PID 2364 wrote to memory of 744 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 11 PID 2364 wrote to memory of 812 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 12 PID 2364 wrote to memory of 848 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 13 PID 2364 wrote to memory of 964 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 15 PID 2364 wrote to memory of 112 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 16 PID 2364 wrote to memory of 328 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 17 PID 2364 wrote to memory of 1032 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 18 PID 2364 wrote to memory of 1112 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 19 PID 2364 wrote to memory of 1172 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 20 PID 2364 wrote to memory of 1232 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 21 PID 2364 wrote to memory of 1200 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 23 PID 2364 wrote to memory of 1448 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 24 PID 2364 wrote to memory of 1612 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 25 PID 2364 wrote to memory of 2192 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 26 PID 2364 wrote to memory of 1896 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 27 PID 2364 wrote to memory of 2520 2364 8597035774a77b998098b82661729452_JaffaCakes118.exe 28
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:588
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:1448
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1612
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"2⤵PID:1172
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:848
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:2520
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:112
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1032
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\8597035774a77b998098b82661729452_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8597035774a77b998098b82661729452_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2364
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵PID:1200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:2192
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:1896