Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 22:27
Static task
static1
Behavioral task
behavioral1
Sample
b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe
-
Size
181KB
-
MD5
b117a16cd74326223549e861ef0b66e9
-
SHA1
1e73b5b10713c0d72738bd6ee839baf6d740f08d
-
SHA256
775c6d281fdccaa04c1ef515d81c901e7770fff95911581a78d57e04baefe8ae
-
SHA512
e8a8afa7f42f294fdd98a8fc2135327251fbaa201c416002ee7722724a91cc3a88e5602c26d1015be62de0c3fc052de733697e24db58fc859c67a1e2488a6cd0
-
SSDEEP
3072:htXtpArxo9OPiYrbhDpk8rVJQzahicYqltQiGv4bGoIbHxsDMBh0yi0wfkDLY5k6:jnA+AiChDpkMVJkahvlK4yoiRsDMBh/p
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\svfjkolf.exe b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1804 svfjkolf.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\keys.ini b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 740 1804 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svfjkolf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1804 wrote to memory of 740 1804 svfjkolf.exe 31 PID 1804 wrote to memory of 740 1804 svfjkolf.exe 31 PID 1804 wrote to memory of 740 1804 svfjkolf.exe 31 PID 1804 wrote to memory of 740 1804 svfjkolf.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b117a16cd74326223549e861ef0b66e9_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:2316
-
C:\Windows\SysWOW64\drivers\svfjkolf.exeC:\Windows\SysWOW64\drivers\svfjkolf.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 2642⤵
- Program crash
PID:740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD5b117a16cd74326223549e861ef0b66e9
SHA11e73b5b10713c0d72738bd6ee839baf6d740f08d
SHA256775c6d281fdccaa04c1ef515d81c901e7770fff95911581a78d57e04baefe8ae
SHA512e8a8afa7f42f294fdd98a8fc2135327251fbaa201c416002ee7722724a91cc3a88e5602c26d1015be62de0c3fc052de733697e24db58fc859c67a1e2488a6cd0