Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe
-
Size
91KB
-
MD5
8e700237875b49ca20eb2cadecc8746d
-
SHA1
98f82bc41b8caced547d1c1b9fb6aa2281f855bf
-
SHA256
5ca47bbbe99b3d58aeece8d2ca5768c03d4c1a3fc344ecefa9c160383a66e8d1
-
SHA512
b80fba99fd38f946299b5dcba6609c3d547ba4d85011eed5a918a639599d59212fc8463f32129606edc7e2f13c4bc2de6cf890676a3b5f1c983d2a375a8d30d7
-
SSDEEP
1536:ZiDLG7z8p+SZjBHdEhIxBtS5Q5grdU3+kNS9Y/bmF6uIo6nX7mNeomBZzJ1J+B0Z:ZifEzyPHdEaaQ5g2Ow2Y/bmF65NCNeoQ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2308 BCSSync.exe 348 BCSSync.exe -
Loads dropped DLL 3 IoCs
pid Process 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 2308 BCSSync.exe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3016 set thread context of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 2308 set thread context of 348 2308 BCSSync.exe 32 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3016 wrote to memory of 3020 3016 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2308 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2308 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2308 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2308 3020 8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe 31 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 2308 wrote to memory of 348 2308 BCSSync.exe 32 PID 348 wrote to memory of 1808 348 BCSSync.exe 34 PID 348 wrote to memory of 1808 348 BCSSync.exe 34 PID 348 wrote to memory of 1808 348 BCSSync.exe 34 PID 348 wrote to memory of 1808 348 BCSSync.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\8e700237875b49ca20eb2cadecc8746d_JaffaCakes118.exe5⤵
- System Location Discovery: System Language Discovery
PID:1808
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5cc38da31b230ab7cf2be78ec470cb68c
SHA193e5e9605bf761ba9bf168695ced8f179c9c159b
SHA25605e5a62b3bc36f098521779474f2c1e6d050590df9f4c37686624180115cf9f6
SHA51259731b10913f2185f690ec34db0187390bfbdda5c1a704fd91999bef7a85f4f25234c125de5b884ceff1986b53fda3f7d63f2302d6755c31d6c218ff6cc091da