Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
-
Size
242KB
-
MD5
b406ba165b8500f3828687dcf14a0165
-
SHA1
79f2490dd858807ecf00749bc8341c04a203370d
-
SHA256
594c467e38874bc9b39adfad370de12f425f17bcf8877b6175c113fa094b2ee4
-
SHA512
65443cfcafd2b0a799f7907ffb61c2e1d0e1fb809fd665c6c6c29186d99ce01a449f7b543efc6a9b1a533273f790e70eb2c7f19557feec404aa0df7ac316beac
-
SSDEEP
6144:68nunPuGRppmMxomdvtf17FLYnzOy0FHChI7YZ:68ipQM/dvtxOnCLChI
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\npf.sys b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1996-3-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1996-12-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1996-7-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1996-5-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1996-21-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sniffer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe" b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\wpcap.dll b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe File created C:\Windows\SysWOW64\Packet.dll b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2520 1996 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2520 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe 30 PID 1996 wrote to memory of 2520 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe 30 PID 1996 wrote to memory of 2520 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe 30 PID 1996 wrote to memory of 2520 1996 b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 1402⤵
- Program crash
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5b4d3cbc053e70143d350d6107b94952c
SHA15ebdb0ef1f00a1024637adf106d7b2a9b43bbcda
SHA2562198fd8cd738d6281c8c1fc4845effd251b3d6b7f83b9f4f927d6430cf12537b
SHA512539244352ffc0ca6e08bba2704abd1286873375dad28421862bd9ce7a8146d9472dc5e4ac3edb59ae741f5b178cd22f976fbba62a0bc71c09160e1c9f178e523
-
Filesize
274KB
MD5dae5f233818083af69e2e5133a50a2cb
SHA118a2672972a9440f51b3d416a933b20b8ae6252a
SHA256b0ce20a14e8cef5a94e2ef057e5685eac3636c6b71166b4f99af31c3422c4121
SHA512ca71f6b0c2c1f5c00eda9af97b4426c9ca386785c5f0d712dc971ddf0b13e1a0e7ef691932b61c5fda009df2da8422df09ffaf5061aa0b674a98dcc57caa405a