Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe
-
Size
39KB
-
MD5
aec294bae947751a21e0cb07900079a3
-
SHA1
23ec3fd3f90a97830c2b680047b690fc5b2a5182
-
SHA256
bd9a530c0807e163222f34c6d1313753ba5ede8815d190090c18afe116817bb8
-
SHA512
30c5e1957baacff347e0a57b6c7a6d5f01e2b70e950641868746b44b12a86219937b73951618be07fac3e42f521f7fbd64baf9297d5ed778f6ede98d484f8621
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4tKMTfGn:vj+jsMQMOtEvwDpj5Ht1TfGn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 316 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2608 aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2608 wrote to memory of 316 2608 aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe 31 PID 2608 wrote to memory of 316 2608 aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe 31 PID 2608 wrote to memory of 316 2608 aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe 31 PID 2608 wrote to memory of 316 2608 aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aec294bae947751a21e0cb07900079a3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5329ca204204416aee5c5b75112bfe154
SHA133e8366c7743fc33b180e77c9817c15c703dc388
SHA256840955974ac78849f07e6dcb722340c8aad380eaa0949b0161a6579dbcd2d928
SHA5120ede1c04a1ef9fcee68dbd46cd1cceac162bf3a776b2192576eb9ea1c0406cfadcd006d4a40c726d18e8e1e3b094f8d68bfa8f544391e77c2f42044e39da79b2