Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe
-
Size
297KB
-
MD5
868f6e8b827d34ca5e371a47eedad73c
-
SHA1
6b371490cbce9f9a7ae9fffd05187ca37e36c7bd
-
SHA256
414770f95067da2c32501ac6eb77035ba738916e6ef4b52932bca711c6c50ce9
-
SHA512
a4236605d2c669131e1b8bb965c43944679760828e3062bd92415ce6f791c991664ae98a6133c9010eb33c2a802f082012812ff0be4b472cc63c73954a414346
-
SSDEEP
3072:Hpe7QPXKomWqLEnCYvcvIXRTy1hmUI0xlOcwSIvS3oGcFuG9hFoHk148GzMwypuR:JjXfvDx8hzNxl8SIvSiFxTO8GzM+
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1296 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1616 kogok.exe -
Loads dropped DLL 1 IoCs
pid Process 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\{75DA6328-6F30-AD4F-96DD-2BAD86C808B0} = "C:\\Users\\Admin\\AppData\\Roaming\\Tuuqek\\kogok.exe" kogok.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1628 set thread context of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kogok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Privacy 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe 1616 kogok.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 1616 kogok.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1616 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 30 PID 1628 wrote to memory of 1616 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 30 PID 1628 wrote to memory of 1616 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 30 PID 1628 wrote to memory of 1616 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 30 PID 1616 wrote to memory of 1200 1616 kogok.exe 19 PID 1616 wrote to memory of 1200 1616 kogok.exe 19 PID 1616 wrote to memory of 1200 1616 kogok.exe 19 PID 1616 wrote to memory of 1200 1616 kogok.exe 19 PID 1616 wrote to memory of 1200 1616 kogok.exe 19 PID 1616 wrote to memory of 1288 1616 kogok.exe 20 PID 1616 wrote to memory of 1288 1616 kogok.exe 20 PID 1616 wrote to memory of 1288 1616 kogok.exe 20 PID 1616 wrote to memory of 1288 1616 kogok.exe 20 PID 1616 wrote to memory of 1288 1616 kogok.exe 20 PID 1616 wrote to memory of 1340 1616 kogok.exe 21 PID 1616 wrote to memory of 1340 1616 kogok.exe 21 PID 1616 wrote to memory of 1340 1616 kogok.exe 21 PID 1616 wrote to memory of 1340 1616 kogok.exe 21 PID 1616 wrote to memory of 1340 1616 kogok.exe 21 PID 1616 wrote to memory of 1080 1616 kogok.exe 23 PID 1616 wrote to memory of 1080 1616 kogok.exe 23 PID 1616 wrote to memory of 1080 1616 kogok.exe 23 PID 1616 wrote to memory of 1080 1616 kogok.exe 23 PID 1616 wrote to memory of 1080 1616 kogok.exe 23 PID 1616 wrote to memory of 1628 1616 kogok.exe 29 PID 1616 wrote to memory of 1628 1616 kogok.exe 29 PID 1616 wrote to memory of 1628 1616 kogok.exe 29 PID 1616 wrote to memory of 1628 1616 kogok.exe 29 PID 1616 wrote to memory of 1628 1616 kogok.exe 29 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31 PID 1628 wrote to memory of 1296 1628 868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe 31
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1200
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1288
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\868f6e8b827d34ca5e371a47eedad73c_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Roaming\Tuuqek\kogok.exe"C:\Users\Admin\AppData\Roaming\Tuuqek\kogok.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp98418c69.bat"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1296
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271B
MD5844eb5a746ac538eaf2327f11624bbdc
SHA1007be1cdd8579d7a4989b3eca69fd240f3e09a23
SHA256bfe2dc15105242222fe5de368f5710d60807de99f7be627fac46797bf9f55bd7
SHA5124290073a6949236d0036b4368a513954ce21d515ccc6ed69dee5cf8ec589ba75981f213236a756f0ed1751864f6252eca483e3afbdf2d8308e96025256085657
-
Filesize
297KB
MD54aac1c266e48d1385a69393b6476c0d4
SHA1e7335723ff0a77279115cb0d65cc3ae724c55eb3
SHA256d70ab6efb326941dc0d69191fdf290385de13dbfa686eb445dc8ad21daf633a7
SHA512b1d0fc00aed13c9f3eea02f3b30637aff2ca1ccafd0a34a6222b6704be4b0a93b8ba9a25f03cb894579fea0a68da7f2bad1496089c6b7f996da385f0b13ace64