Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
895783109871b4953b23789d7803319f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
895783109871b4953b23789d7803319f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
895783109871b4953b23789d7803319f_JaffaCakes118.exe
-
Size
356KB
-
MD5
895783109871b4953b23789d7803319f
-
SHA1
c596a7fbcd31f358141a4909aae68348e4d17d90
-
SHA256
58546155a7a5a00036bcdda1a31079c44cbb946017280fb8f8214881a5b66d2e
-
SHA512
ab3e1cee7dc4743d19f6369333e96026cf14758460ebc7c8ef74712513cf47c0681723c68eb827dbebf3b96a05a0e0a3f2e608f16d6162f50ec14825ab2d7363
-
SSDEEP
6144:s/9EhIuv6fIjEit6S4o15rsewIi2hHdKoOCtIrpa5dd3uGD/RnNFB:MoIstv7rsxM9m3rIddldnNFB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2644 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 708 qdbmo.exe -
Loads dropped DLL 3 IoCs
pid Process 2644 cmd.exe 2644 cmd.exe 708 qdbmo.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895783109871b4953b23789d7803319f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qdbmo.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2644 cmd.exe 2732 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2820 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2732 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2820 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe 708 qdbmo.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2644 2152 895783109871b4953b23789d7803319f_JaffaCakes118.exe 30 PID 2152 wrote to memory of 2644 2152 895783109871b4953b23789d7803319f_JaffaCakes118.exe 30 PID 2152 wrote to memory of 2644 2152 895783109871b4953b23789d7803319f_JaffaCakes118.exe 30 PID 2152 wrote to memory of 2644 2152 895783109871b4953b23789d7803319f_JaffaCakes118.exe 30 PID 2644 wrote to memory of 2820 2644 cmd.exe 32 PID 2644 wrote to memory of 2820 2644 cmd.exe 32 PID 2644 wrote to memory of 2820 2644 cmd.exe 32 PID 2644 wrote to memory of 2820 2644 cmd.exe 32 PID 2644 wrote to memory of 2732 2644 cmd.exe 34 PID 2644 wrote to memory of 2732 2644 cmd.exe 34 PID 2644 wrote to memory of 2732 2644 cmd.exe 34 PID 2644 wrote to memory of 2732 2644 cmd.exe 34 PID 2644 wrote to memory of 708 2644 cmd.exe 35 PID 2644 wrote to memory of 708 2644 cmd.exe 35 PID 2644 wrote to memory of 708 2644 cmd.exe 35 PID 2644 wrote to memory of 708 2644 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\895783109871b4953b23789d7803319f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\895783109871b4953b23789d7803319f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2152 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\895783109871b4953b23789d7803319f_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\qdbmo.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 21523⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2732
-
-
C:\Users\Admin\AppData\Local\qdbmo.exeC:\Users\Admin\AppData\Local\qdbmo.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
MD5895783109871b4953b23789d7803319f
SHA1c596a7fbcd31f358141a4909aae68348e4d17d90
SHA25658546155a7a5a00036bcdda1a31079c44cbb946017280fb8f8214881a5b66d2e
SHA512ab3e1cee7dc4743d19f6369333e96026cf14758460ebc7c8ef74712513cf47c0681723c68eb827dbebf3b96a05a0e0a3f2e608f16d6162f50ec14825ab2d7363