Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 03:32
Static task
static1
Behavioral task
behavioral1
Sample
b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe
-
Size
183KB
-
MD5
b62ffd49bff76c8fb3e94e4d6d7eef38
-
SHA1
9b8c52cc18f41ddf985879a950ee8f4d72713fd7
-
SHA256
ee9b6d599fa083106b88969579de65a53ac6c9e1f5d30f4309a6ad557d7348ff
-
SHA512
bffa9d3644d9fddf50a0f58637fc04f7ae0cc5dc198ffcdaf41a7f34c92da3e985039220530d5f250ac7b910d2c4dd0743fa2cc102a6edc23888349664013856
-
SSDEEP
3072:bMqKbTtCSIT0chwzzcdZKF8UvvoeWofjjpAVioRF8s//NLj6h+EvtRHD:o9MMmwzlqUHoeWofjjpAViY/lH6h+Evj
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2420-8-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral1/memory/2420-5-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral1/memory/2420-2-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral1/memory/2420-18-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX294B1FA4 = "C:\\Windows\\XXXXXX294B1FA4\\svchsot.exe" b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\XXXXXX294B1FA4\JH.BAT b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2472 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe -
System Service Discovery 1 TTPs 2 IoCs
Adversaries may try to gather information about registered local system services.
pid Process 868 net.exe 2708 net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1336 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 30 PID 2420 wrote to memory of 1336 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 30 PID 2420 wrote to memory of 1336 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 30 PID 2420 wrote to memory of 1336 2420 b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe 30 PID 1336 wrote to memory of 2364 1336 cmd.exe 32 PID 1336 wrote to memory of 2364 1336 cmd.exe 32 PID 1336 wrote to memory of 2364 1336 cmd.exe 32 PID 1336 wrote to memory of 2364 1336 cmd.exe 32 PID 1336 wrote to memory of 2472 1336 cmd.exe 33 PID 1336 wrote to memory of 2472 1336 cmd.exe 33 PID 1336 wrote to memory of 2472 1336 cmd.exe 33 PID 1336 wrote to memory of 2472 1336 cmd.exe 33 PID 1336 wrote to memory of 868 1336 cmd.exe 34 PID 1336 wrote to memory of 868 1336 cmd.exe 34 PID 1336 wrote to memory of 868 1336 cmd.exe 34 PID 1336 wrote to memory of 868 1336 cmd.exe 34 PID 868 wrote to memory of 2708 868 net.exe 35 PID 868 wrote to memory of 2708 868 net.exe 35 PID 868 wrote to memory of 2708 868 net.exe 35 PID 868 wrote to memory of 2708 868 net.exe 35 PID 1336 wrote to memory of 576 1336 cmd.exe 36 PID 1336 wrote to memory of 576 1336 cmd.exe 36 PID 1336 wrote to memory of 576 1336 cmd.exe 36 PID 1336 wrote to memory of 576 1336 cmd.exe 36 PID 1336 wrote to memory of 2704 1336 cmd.exe 37 PID 1336 wrote to memory of 2704 1336 cmd.exe 37 PID 1336 wrote to memory of 2704 1336 cmd.exe 37 PID 1336 wrote to memory of 2704 1336 cmd.exe 37 PID 1336 wrote to memory of 2860 1336 cmd.exe 38 PID 1336 wrote to memory of 2860 1336 cmd.exe 38 PID 1336 wrote to memory of 2860 1336 cmd.exe 38 PID 1336 wrote to memory of 2860 1336 cmd.exe 38 PID 1336 wrote to memory of 3060 1336 cmd.exe 39 PID 1336 wrote to memory of 3060 1336 cmd.exe 39 PID 1336 wrote to memory of 3060 1336 cmd.exe 39 PID 1336 wrote to memory of 3060 1336 cmd.exe 39 PID 1336 wrote to memory of 2748 1336 cmd.exe 40 PID 1336 wrote to memory of 2748 1336 cmd.exe 40 PID 1336 wrote to memory of 2748 1336 cmd.exe 40 PID 1336 wrote to memory of 2748 1336 cmd.exe 40 PID 1336 wrote to memory of 2216 1336 cmd.exe 41 PID 1336 wrote to memory of 2216 1336 cmd.exe 41 PID 1336 wrote to memory of 2216 1336 cmd.exe 41 PID 1336 wrote to memory of 2216 1336 cmd.exe 41 PID 1336 wrote to memory of 3052 1336 cmd.exe 42 PID 1336 wrote to memory of 3052 1336 cmd.exe 42 PID 1336 wrote to memory of 3052 1336 cmd.exe 42 PID 1336 wrote to memory of 3052 1336 cmd.exe 42 PID 1336 wrote to memory of 2552 1336 cmd.exe 43 PID 1336 wrote to memory of 2552 1336 cmd.exe 43 PID 1336 wrote to memory of 2552 1336 cmd.exe 43 PID 1336 wrote to memory of 2552 1336 cmd.exe 43 PID 1336 wrote to memory of 2964 1336 cmd.exe 44 PID 1336 wrote to memory of 2964 1336 cmd.exe 44 PID 1336 wrote to memory of 2964 1336 cmd.exe 44 PID 1336 wrote to memory of 2964 1336 cmd.exe 44 PID 1336 wrote to memory of 1028 1336 cmd.exe 45 PID 1336 wrote to memory of 1028 1336 cmd.exe 45 PID 1336 wrote to memory of 1028 1336 cmd.exe 45 PID 1336 wrote to memory of 1028 1336 cmd.exe 45 PID 1336 wrote to memory of 2772 1336 cmd.exe 46 PID 1336 wrote to memory of 2772 1336 cmd.exe 46 PID 1336 wrote to memory of 2772 1336 cmd.exe 46 PID 1336 wrote to memory of 2772 1336 cmd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b62ffd49bff76c8fb3e94e4d6d7eef38_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\XXXXXX294B1FA4\JH.BAT2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f3⤵
- System Location Discovery: System Language Discovery
PID:2364
-
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2472
-
-
C:\Windows\SysWOW64\net.exenet start "Task Scheduler"3⤵
- System Location Discovery: System Language Discovery
- System Service Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Task Scheduler"4⤵
- System Location Discovery: System Language Discovery
- System Service Discovery
PID:2708
-
-
-
C:\Windows\SysWOW64\at.exeAt 0:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:576
-
-
C:\Windows\SysWOW64\at.exeAt 1:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Windows\SysWOW64\at.exeAt 2:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\at.exeAt 3:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3060
-
-
C:\Windows\SysWOW64\at.exeAt 4:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Windows\SysWOW64\at.exeAt 5:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Windows\SysWOW64\at.exeAt 6:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:3052
-
-
C:\Windows\SysWOW64\at.exeAt 7:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\SysWOW64\at.exeAt 8:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\Windows\SysWOW64\at.exeAt 9:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1028
-
-
C:\Windows\SysWOW64\at.exeAt 10:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
C:\Windows\SysWOW64\at.exeAt 11:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Windows\SysWOW64\at.exeAt 12:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2608
-
-
C:\Windows\SysWOW64\at.exeAt 13:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2640
-
-
C:\Windows\SysWOW64\at.exeAt 14:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Windows\SysWOW64\at.exeAt 15:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2648
-
-
C:\Windows\SysWOW64\at.exeAt 16:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:796
-
-
C:\Windows\SysWOW64\at.exeAt 17:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:468
-
-
C:\Windows\SysWOW64\at.exeAt 18:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:836
-
-
C:\Windows\SysWOW64\at.exeAt 19:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:848
-
-
C:\Windows\SysWOW64\at.exeAt 20:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1836
-
-
C:\Windows\SysWOW64\at.exeAt 21:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2036
-
-
C:\Windows\SysWOW64\at.exeAt 22:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\Windows\SysWOW64\at.exeAt 23:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1628
-
-
C:\Windows\SysWOW64\at.exeAt 24:00 C:\Windows\XXXXXX294B1FA4\svchsot.exe3⤵
- System Location Discovery: System Language Discovery
PID:1364
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50794cf28a0162c1bf6c662fda2e5a9f1
SHA1052e1dd1bd2bd5e64acd9bb3134747242c76cba5
SHA2566dea3dabef075fa44b2ba8728b83cebc929c944f909b49f5e243b4597aab3266
SHA5129b1c915958523a9d15f0108f8daa127592b98e6d806ce58155c0994e2f9bc98103d2c5389c05d6f5f0e86de53c92b39d4603072a1d1239965569711490469dc8