Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
b8d304752d36902f26a08685014dacce_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b8d304752d36902f26a08685014dacce_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b8d304752d36902f26a08685014dacce_JaffaCakes118.exe
-
Size
41KB
-
MD5
b8d304752d36902f26a08685014dacce
-
SHA1
7a0c98dcd0066c8252829e90248def791043135a
-
SHA256
1dc0ad1f392e7a115ef558abde9005dbd22ab38ec8e36eca75cd990c631ce212
-
SHA512
701b76a6267cc63cbfe241d5fb168657ee141eb4c4c269c3c982afc9a605a573c726cd426b41eefeb0b8076659c7a3c9a7ce3ac56dda2f66093360ebc8104a3e
-
SSDEEP
768:v2/E3pVDeALOjwOrmnY5FnTGxM5E7TRPoZq6r43jlW1rctrcQiS5kz+k:v13LPqfZ3f5E7TRPUUg1rqQ6kik
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2944 hqhitdtf.exe -
Executes dropped EXE 5 IoCs
pid Process 2944 hqhitdtf.exe 1280 hqhitdtf.exe 2308 hqhitdtf.exe 2672 hqhitdtf.exe 1044 hqhitdtf.exe -
Loads dropped DLL 18 IoCs
pid Process 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 2944 hqhitdtf.exe 2944 hqhitdtf.exe 2944 hqhitdtf.exe 2944 hqhitdtf.exe 1280 hqhitdtf.exe 1280 hqhitdtf.exe 1280 hqhitdtf.exe 1280 hqhitdtf.exe 2308 hqhitdtf.exe 2308 hqhitdtf.exe 2308 hqhitdtf.exe 2308 hqhitdtf.exe 2672 hqhitdtf.exe 2672 hqhitdtf.exe 2672 hqhitdtf.exe 2672 hqhitdtf.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\hqhitdtf.exe b8d304752d36902f26a08685014dacce_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\hqhitdtf.exe b8d304752d36902f26a08685014dacce_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8d304752d36902f26a08685014dacce_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hqhitdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hqhitdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hqhitdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hqhitdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hqhitdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hqhitdtf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID b8d304752d36902f26a08685014dacce_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001} b8d304752d36902f26a08685014dacce_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hqhitdtf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hqhitdtf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hqhitdtf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node b8d304752d36902f26a08685014dacce_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hqhitdtf.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2496 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 30 PID 2132 wrote to memory of 2944 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 31 PID 2132 wrote to memory of 2944 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 31 PID 2132 wrote to memory of 2944 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 31 PID 2132 wrote to memory of 2944 2132 b8d304752d36902f26a08685014dacce_JaffaCakes118.exe 31 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 2412 2944 hqhitdtf.exe 32 PID 2944 wrote to memory of 1280 2944 hqhitdtf.exe 33 PID 2944 wrote to memory of 1280 2944 hqhitdtf.exe 33 PID 2944 wrote to memory of 1280 2944 hqhitdtf.exe 33 PID 2944 wrote to memory of 1280 2944 hqhitdtf.exe 33 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2720 1280 hqhitdtf.exe 34 PID 1280 wrote to memory of 2308 1280 hqhitdtf.exe 35 PID 1280 wrote to memory of 2308 1280 hqhitdtf.exe 35 PID 1280 wrote to memory of 2308 1280 hqhitdtf.exe 35 PID 1280 wrote to memory of 2308 1280 hqhitdtf.exe 35 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2832 2308 hqhitdtf.exe 36 PID 2308 wrote to memory of 2672 2308 hqhitdtf.exe 38 PID 2308 wrote to memory of 2672 2308 hqhitdtf.exe 38 PID 2308 wrote to memory of 2672 2308 hqhitdtf.exe 38 PID 2308 wrote to memory of 2672 2308 hqhitdtf.exe 38 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 2012 2672 hqhitdtf.exe 39 PID 2672 wrote to memory of 1044 2672 hqhitdtf.exe 40 PID 2672 wrote to memory of 1044 2672 hqhitdtf.exe 40 PID 2672 wrote to memory of 1044 2672 hqhitdtf.exe 40 PID 2672 wrote to memory of 1044 2672 hqhitdtf.exe 40 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41 PID 1044 wrote to memory of 2896 1044 hqhitdtf.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d304752d36902f26a08685014dacce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b8d304752d36902f26a08685014dacce_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s2⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
C:\windows\SysWOW64\hqhitdtf.exe"C:\windows\system32\hqhitdtf.exe" -kill c:\users\admin\appdata\local\temp\b8d304752d36902f26a08685014dacce_jaffacakes118.exe /install2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s3⤵
- System Location Discovery: System Language Discovery
PID:2412
-
-
C:\windows\SysWOW64\hqhitdtf.exe"C:\windows\system32\hqhitdtf.exe" -kill c:\windows\syswow64\hqhitdtf.exe /install /install3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s4⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\windows\SysWOW64\hqhitdtf.exe"C:\windows\system32\hqhitdtf.exe" -kill c:\windows\syswow64\hqhitdtf.exe /install /install /install4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s5⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\windows\SysWOW64\hqhitdtf.exe"C:\windows\system32\hqhitdtf.exe" -kill c:\windows\syswow64\hqhitdtf.exe /install /install /install /install5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s6⤵
- System Location Discovery: System Language Discovery
PID:2012
-
-
C:\windows\SysWOW64\hqhitdtf.exe"C:\windows\system32\hqhitdtf.exe" -kill c:\windows\syswow64\hqhitdtf.exe /install /install /install /install /install6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s7⤵
- System Location Discovery: System Language Discovery
PID:2896
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5b8d304752d36902f26a08685014dacce
SHA17a0c98dcd0066c8252829e90248def791043135a
SHA2561dc0ad1f392e7a115ef558abde9005dbd22ab38ec8e36eca75cd990c631ce212
SHA512701b76a6267cc63cbfe241d5fb168657ee141eb4c4c269c3c982afc9a605a573c726cd426b41eefeb0b8076659c7a3c9a7ce3ac56dda2f66093360ebc8104a3e