Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe
-
Size
124KB
-
MD5
a3d46b3546ab528e9d852a73186f9671
-
SHA1
a07a7771d168effcd834aa9d2ac94d3214a5a809
-
SHA256
e5777cdbf2bcfc7d6aec92d41d2634975518a2b0d20d6da136307c8302d6fd8d
-
SHA512
3b19dc890029f33e650504c34599c1714fbc8af714e5b9f001e4a054049d22d99122f7d32694d3d93a85a531eaf3bea4e7b48c0b30ca432d491dd7439208926a
-
SSDEEP
3072:F+vEEEIRBuTJQ5XD1/xGRm3MEn96K3H1UZpXbv9xD13:OEQBuyXD5nqx
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2060 BCSSync.exe 848 BCSSync.exe 2700 BCSSync.exe -
Loads dropped DLL 2 IoCs
pid Process 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe -
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 Destination IP 178.162.181.106 -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1916 set thread context of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 2616 set thread context of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2060 set thread context of 848 2060 BCSSync.exe 33 PID 848 set thread context of 2700 848 BCSSync.exe 34 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Fonts\5401e0V5w.com a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 2700 BCSSync.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 2060 BCSSync.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 1916 wrote to memory of 2616 1916 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 30 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2616 wrote to memory of 2160 2616 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 31 PID 2160 wrote to memory of 2060 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2060 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2060 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 32 PID 2160 wrote to memory of 2060 2160 a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe 32 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 2060 wrote to memory of 848 2060 BCSSync.exe 33 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 848 wrote to memory of 2700 848 BCSSync.exe 34 PID 2700 wrote to memory of 448 2700 BCSSync.exe 35 PID 2700 wrote to memory of 448 2700 BCSSync.exe 35 PID 2700 wrote to memory of 448 2700 BCSSync.exe 35 PID 2700 wrote to memory of 448 2700 BCSSync.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\a3d46b3546ab528e9d852a73186f9671_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"7⤵
- System Location Discovery: System Language Discovery
PID:448
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD52d43b2f2241c2d1caf6542a75a2707b8
SHA1b86a04c06314b0ce679ae1985ff19204982ab940
SHA256df4529e5d3d2d68e44e0fdb191e8ef8acba657e16626e1119a1d81c10902fa91
SHA5127c2f95b2ade2f489f9cafbefdd4c5731d5222347f1f47962d7d9fa15442dde44e7b34681a766881b9057c8dac11237051bcb32b12afb20208d1fc969afffc4c1