Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe
-
Size
20KB
-
MD5
8b26101dcd4ca89e3221f1fddd27c5a3
-
SHA1
f215ce5cde9eb0f4566f2bafa7c5dc5813f8b13d
-
SHA256
f11143a9ec5060136d0f3dde69e0de94a1b013e6cb6790bdddea75898b3bfed3
-
SHA512
adf11d576980982cd1f71d115a2036d559d8667d65e4509e105f35a568f1d9ecdaf35245b5dc3458a67567378aadd3be1ac0bef048bf6aed8bec8545f640f520
-
SSDEEP
384:sjHpLawENkMcT3dblG3ijwJk70V8OEdojDJb640meMFeWvwWd:6LaTNkJT3dbIyjwJk70V8dUY4qIv
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\WinFastUserSwitchingCompatibilityEx.dll" 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2784 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 2384 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe 2416 svchost.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WinFastUserSwitchingCompatibilityEx.dll 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe File created C:\Windows\SysWOW64\MgicRcRk10.sys 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinFastUserSwitchingCompatibilityEx.dll 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2384 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 476 Process not Found 476 Process not Found -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2784 2384 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe 31 PID 2384 wrote to memory of 2784 2384 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe 31 PID 2384 wrote to memory of 2784 2384 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe 31 PID 2384 wrote to memory of 2784 2384 8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8b26101dcd4ca89e3221f1fddd27c5a3_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\259443843.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269B
MD5ffe3a2c055c29352283858d2b1335b84
SHA12a7dd398172e6e84c0f4c9adc800a31b70cac71e
SHA2561e329bdc986f1b26d50dae66e9c20468429c8ab94d9e5664229fb253ce911c83
SHA5127bf9c5bcc28a3c8661e3d3d0c62e265419d305b732edc917af8ef9cfcd946d173ab318591ca5e184e1a89af91386eab8d261367a95428654be1075d201e4277a
-
Filesize
17KB
MD5ccbfdf23c80e3eed8cb3e300cc6a7af8
SHA1fbf306b146705ca9604cd67aea6f384173d3aa24
SHA256d1bbc2e2ade383a996542bd84fb15a36c0fa41120bf01ab511a17aa69eed8cc0
SHA512486c71f29be4e4c99335cadf4faa4389ac6c6fa75d25abb64ceb93e232884668584ba89400bd1e6e9d7c2206c69efdd8ee7168bf44d16596b917f0d24146e5d0