Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
ac9f2259ac4b8c19db9123e822f3a107
-
SHA1
88267d8ac120780655976607f02b960bedf3a9b5
-
SHA256
c3cb9eea09d75baf41a2f144cc13f68a1c0b1629dccdf9f60a4dfdc5f57161ff
-
SHA512
35002ce9923ad9cd656c48b0b8b1e12bd2fcdc8081328c287277909201ed53a8332c07a7fbb181eae9a73516a2246936788459dfd632db6ebf2017466261c216
-
SSDEEP
24576:uY7426SR4y0K2+ObYkmOBkSCk0Oshvqb4UVlavIK:uwZKbVSSCJFrgla
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2280 ftbret24lt0.exe -
Loads dropped DLL 2 IoCs
pid Process 2324 ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe 2324 ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftbret24lt0.exe = "C:\\Users\\Admin\\AppData\\Roaming\\4EE95EEDAD340BE0DED876AB03A25D15\\ftbret24lt0.exe" ftbret24lt0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftbret24lt0.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe 2280 ftbret24lt0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2280 2324 ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2280 2324 ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2280 2324 ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2280 2324 ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac9f2259ac4b8c19db9123e822f3a107_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Roaming\4EE95EEDAD340BE0DED876AB03A25D15\ftbret24lt0.exe"C:\Users\Admin\AppData\Roaming\4EE95EEDAD340BE0DED876AB03A25D15\ftbret24lt0.exe" -i 4EE95EEDAD340BE0DED876AB03A25D15 70716241002⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD54cedefbdba364223db3bbc5b6647648d
SHA12456630305827aa2b090b65e646dac73bc8e29dc
SHA2563e2b3d7fc990e3fb36e2e8ee83de74d29e71e04e8d37ee348d0f8ca86eb52f3b
SHA512fc080dfadb4259c4a859b83a2a0fa8ef5518b96b7c756f9646b2f89b28a88aa8b72bdef9c8e2f314977448c28a1ecc07a973c31f716ae38a57102a958c91f564
-
Filesize
1.0MB
MD54d60e2a263831d0a556a9e3e930fa313
SHA1020db90c81fd3fcb2b2fbf37ea07209b03ba05e0
SHA2563c3ff9960dba55d5529e17c8ea579274303f59045a653f49ed51f2124f39b35e
SHA51232afd89d9e2bd53dd5657292562bfc39af72c8735bb0a247808705754cad56977284561294ea89a197938e06e40a702ade255a3626b1158394f9c76d36ca6725