Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe
-
Size
20KB
-
MD5
b2b7034e86a3f25700d0fd19722c4e12
-
SHA1
b2602b87d85d3735f1d3c9b2ef74057fcce697aa
-
SHA256
00ea4247ec70074f4bacee34967b5049a53579dbe62d2f9d7602c773d8909d5d
-
SHA512
50bec6d8125afbcad6286101e13088f0e87e0c07779f80b8b496cac721a15b8bd44d749b382c4f5148f912cbb3b35a7b59e4b8454dfdbf66705319617895aba1
-
SSDEEP
384:FhtsriVIKBpSuZsNmZNUWcE8yOTQSMdDO1pyL/pxpNnjJEmz:pbZsNmZeWcE8otcWRVjh
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2524 3004 WerFault.exe 30 -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 IEXPLORE.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2076 set thread context of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3004 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 2076 wrote to memory of 3004 2076 b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe 30 PID 3004 wrote to memory of 2524 3004 IEXPLORE.EXE 31 PID 3004 wrote to memory of 2524 3004 IEXPLORE.EXE 31 PID 3004 wrote to memory of 2524 3004 IEXPLORE.EXE 31 PID 3004 wrote to memory of 2524 3004 IEXPLORE.EXE 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b2b7034e86a3f25700d0fd19722c4e12_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1563⤵
- Program crash
PID:2524
-
-