Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe
-
Size
57KB
-
MD5
8a7c7bf658abd83567dae93079efcf56
-
SHA1
fc4c89d005152ce65a02082b45f5b790f47310a5
-
SHA256
5274344b4f4b795fd26e838018548507acd13123087131b0d8c2cfdabc0ac8de
-
SHA512
0fc6270daf10b9f1489f09e6cd0433e174dd20afbf60b31d8819098bdd754bbe744298212e388504f3f2ccdb649f7c32a6b4dc03ef58cd7a3ed06a96dab94fae
-
SSDEEP
1536:WqBwbLWJLJFKqAZzrZA4kJJ6VplAfEXhL4PEPZxrYYwe:WqBFJLzgOJJ8w0LgEPzrYQ
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe File opened for modification C:\PROGRA~1\INTERN~1\ieframe.dll cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe Token: SeBackupPrivilege 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31 PID 2088 wrote to memory of 2464 2088 8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a7c7bf658abd83567dae93079efcf56_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.execmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\ife.txt "C:\PROGRA~1\INTERN~1\ieframe.dll" /a2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.5MB
MD5f903b09154f976fa5a1fe98d2335e11f
SHA14ab8e37d6ceeb4e1410e36d7da8565923f6abcbb
SHA256c86d29b2287a8b548b0d60c25e5185578ef779185a6c8a82fbf06e3f80e14d68
SHA51204169bf78cf3ed1025343c225df7ab0c362e5984299914fb553b9f6207be9ecb4ac60334c2e57a36a26ef667bb0594f76bfb5d5a2ca9feae9d272eccaa3cd4cd
-
Filesize
6KB
MD5e54eb27fb5048964e8d1ec7a1f72334b
SHA12b76d7aedafd724de96532b00fbc6c7c370e4609
SHA256ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824
SHA512c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4
-
Filesize
10KB
MD538977533750fe69979b2c2ac801f96e6
SHA174643c30cda909e649722ed0c7f267903558e92a
SHA256b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53