Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 14:37
Behavioral task
behavioral1
Sample
9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe
-
Size
14KB
-
MD5
9680030bd03d17653c63b4731ee91111
-
SHA1
92a8a08bf05254baab19360672888a8d08c26a58
-
SHA256
376c466871ff1fa4dbc4ab1b523fda7c71e25501f87acb7a674d20ebab2178d8
-
SHA512
9b3638e6719f34bbcb1b8ea807abb1980bf9123cb14074f1a745aa130abd9c3baeef1334012408e622ef61f1083daf5fc661022878c0280a0ee738bbd2574f72
-
SSDEEP
384:k4Ful4tuVdqYVTcD6OYf436uLwXLJ9EJKskAB:kT6Cg4cDy439wLsX
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Deletes itself 1 IoCs
pid Process 2708 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3044 cenbeznk.exe -
Loads dropped DLL 2 IoCs
pid Process 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2624-1-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/files/0x0009000000016d19-3.dat upx behavioral1/memory/3044-12-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/2624-13-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/3044-14-0x0000000000400000-0x0000000000411000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cenbeznk.exe 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe File created C:\Windows\SysWOW64\cenbezn.dll 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe File created C:\Windows\SysWOW64\cenbeznk.exe 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2624 wrote to memory of 3044 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 31 PID 2624 wrote to memory of 3044 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 31 PID 2624 wrote to memory of 3044 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 31 PID 2624 wrote to memory of 3044 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 31 PID 2624 wrote to memory of 2708 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 32 PID 2624 wrote to memory of 2708 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 32 PID 2624 wrote to memory of 2708 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 32 PID 2624 wrote to memory of 2708 2624 9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cenbeznk.exeC:\Windows\system32\cenbeznk.exe ˜‰2⤵
- Executes dropped EXE
PID:3044
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\9680030bd03d17653c63b4731ee91111_JaffaCakes118.exe.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD5c86a0c4cd09c1128138d449618f92043
SHA10794204d79c5be2453eb04d80c073dd7507f926b
SHA256520a17401eb6811c99113794a55bdda21071392c8e73090e6618517306d33007
SHA5129eeac7185b047a1679be3ad3c5cb8650bba91556a42c385342872ca5a9721d3f9688d1e7447e6686e840e61280f53036c9a271706250c851f65ac345c7fb315e
-
Filesize
14KB
MD59680030bd03d17653c63b4731ee91111
SHA192a8a08bf05254baab19360672888a8d08c26a58
SHA256376c466871ff1fa4dbc4ab1b523fda7c71e25501f87acb7a674d20ebab2178d8
SHA5129b3638e6719f34bbcb1b8ea807abb1980bf9123cb14074f1a745aa130abd9c3baeef1334012408e622ef61f1083daf5fc661022878c0280a0ee738bbd2574f72