Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 12:46
Static task
static1
Behavioral task
behavioral1
Sample
b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe
-
Size
332KB
-
MD5
b381461c2e2c87feec1141428dfdbae5
-
SHA1
3142fad60b3237cd5ff5fa51c8e645394768e771
-
SHA256
0c4b95d1301ae9f5be0add1cce7c92cf7041f7c6a7531222e922668714c09ee7
-
SHA512
907b8efb4b6b31e90646fd1baea48a7b4d0b571c88555ccabe61794935b0e7cb33164d43ead5379ef2164cb1a540cd60f8cd644eefe5307e229c783b9db958d3
-
SSDEEP
6144:o3KEwUBFlfvryauVcy+jJfCG6S36YcRsQV6y8n:ttUdua2236dKQVm
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2260 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2260 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 30 PID 3040 wrote to memory of 2260 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 30 PID 3040 wrote to memory of 2260 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 30 PID 3040 wrote to memory of 2260 3040 b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b381461c2e2c87feec1141428dfdbae5_JaffaCakes118.exe"2⤵
- Executes dropped EXE
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
848KB
MD563d3fda30cd5bcec7f2dd64a49591900
SHA149c0d343c556758a6d3436e6f45ace8cfd20990e
SHA256623a60c7f9ddbd0f05e1a2c8b82c78240ef5fa4f1bde4504889e6c6817e264dc
SHA512380b19f82fc6d9fe65f4c5f2c5ac7b5e7f2e7b1de1a3cc98930bfd5ee7d88c1dd9371527f3fb18537b9b141b8504b91e3cc811858098f92407143687b681322c