Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe
-
Size
75KB
-
MD5
a40c77beae013005a230ce082c780b6f
-
SHA1
08929a1517673aa32f0d74736fc6f2640a9ca9de
-
SHA256
8b66d02d464683ea036c32d10bb418a4e60199188fe96094b31a218ba93e5daf
-
SHA512
e467203a243d8be8e9444d2bd6d9745935fa6a33e3a1e9c16fc5b2a2d946c313b5150992604933497620e57e330f4e9c584a47c2bc879f1bf8892010e4a89db7
-
SSDEEP
1536:Ms0+GLR/25T8QtVDr7+xufs8Ped4CpJLXKuO5jb0PoahBKh:F5Wo8QtVCufzP+p58lPahBKh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2200 explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 3000 jjqcdyb.exe -
Loads dropped DLL 4 IoCs
pid Process 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 3000 jjqcdyb.exe 3000 jjqcdyb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jjqcdyb = "c:\\windows\\system32\\jjqcdyb.exe" a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\jjqcdyb.exe a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\jjqcdyb.exe a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\jjqcdyb.exe jjqcdyb.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1984 set thread context of 2200 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 31 PID 3000 set thread context of 2104 3000 jjqcdyb.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjqcdyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3000 jjqcdyb.exe Token: SeIncBasePriorityPrivilege 3000 jjqcdyb.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1984 wrote to memory of 3000 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 30 PID 1984 wrote to memory of 3000 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 30 PID 1984 wrote to memory of 3000 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 30 PID 1984 wrote to memory of 3000 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 30 PID 1984 wrote to memory of 2200 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 31 PID 1984 wrote to memory of 2200 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 31 PID 1984 wrote to memory of 2200 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 31 PID 1984 wrote to memory of 2200 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 31 PID 1984 wrote to memory of 2200 1984 a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe 31 PID 3000 wrote to memory of 2104 3000 jjqcdyb.exe 32 PID 3000 wrote to memory of 2104 3000 jjqcdyb.exe 32 PID 3000 wrote to memory of 2104 3000 jjqcdyb.exe 32 PID 3000 wrote to memory of 2104 3000 jjqcdyb.exe 32 PID 3000 wrote to memory of 2104 3000 jjqcdyb.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a40c77beae013005a230ce082c780b6f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\windows\SysWOW64\jjqcdyb.exe"c:\windows\system32\jjqcdyb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
PID:2104
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5a40c77beae013005a230ce082c780b6f
SHA108929a1517673aa32f0d74736fc6f2640a9ca9de
SHA2568b66d02d464683ea036c32d10bb418a4e60199188fe96094b31a218ba93e5daf
SHA512e467203a243d8be8e9444d2bd6d9745935fa6a33e3a1e9c16fc5b2a2d946c313b5150992604933497620e57e330f4e9c584a47c2bc879f1bf8892010e4a89db7