Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe
-
Size
705KB
-
MD5
b184ac9a0be0fd396c40be1029f6a22a
-
SHA1
7e1ddc24be4ceccdb9c41b6191ee5c00a48ea444
-
SHA256
5c1b2fb2c904e32a9c3226df01bcd74ed13f6fff82d2bc5524fb3de462036e24
-
SHA512
50632312a7e3e656382f5e67607f47a39ed75eafa7d81e02878d88f56ab509d19bc01bc54223c9e2c278f7090ec138919d72800774becd76ad6a066193b22c24
-
SSDEEP
12288:5na9YiSfSUVav4CZX/cCov9q/HJFFvnfv01HII7ObtcvS38LCJQBtdGs1rBLsJ:5nair9VagCWZ9qDNf81olkS3rJQBtUkq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp -
Loads dropped DLL 5 IoCs
pid Process 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe -
Kills process with taskkill 1 IoCs
pid Process 264 taskkill.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 264 taskkill.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2564 1052 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe 30 PID 2564 wrote to memory of 408 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 31 PID 2564 wrote to memory of 408 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 31 PID 2564 wrote to memory of 408 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 31 PID 2564 wrote to memory of 408 2564 b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp 31 PID 408 wrote to memory of 264 408 cmd.exe 33 PID 408 wrote to memory of 264 408 cmd.exe 33 PID 408 wrote to memory of 264 408 cmd.exe 33 PID 408 wrote to memory of 264 408 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\is-J8RD9.tmp\b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-J8RD9.tmp\b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.tmp" /SL5="$40112,398800,54272,C:\Users\Admin\AppData\Local\Temp\b184ac9a0be0fd396c40be1029f6a22a_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c taskkill /f /im rkverify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rkverify.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:264
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252B
MD5a06e8193846cb6bddb660efec5b06ce1
SHA141796376c01ec1fae9ffae63384fceec85a57aa2
SHA25656794f1a621bf99f06bd84210b03955420464ba42a2120412ff090b606f2b3fb
SHA512f0c9566702189b077294a9b7a3989aea56ed031337faae0d9a1978c0c1daff2ea1e6fee82c43e6eef4f4812f8617499e188b6cb1f8e2222738305f7a267eb152
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
49KB
MD502ecc74f7f91e9ffd84de708683236a6
SHA13532de0b77df8b0fc89e9c7eddec3fa71f98f5a2
SHA25630ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e
SHA512a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891