Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe
-
Size
70KB
-
MD5
bd3813b98ff4ea97d99deaf930e1b2a2
-
SHA1
12a5f73bb80f7dd3f0e101b3d5bbb37d52d5087b
-
SHA256
06a13a32abc56e64fd1ff39308e620f3fdd317a40ee164cf393b6a4ef26227ef
-
SHA512
eca985db9f5bfe35863a5a06896c1e3cd2688d363d54a79b20dcc3778f9c45d4c85203be1a37e3bb877cf6c4b29bbd00eb92ca995eb16186f7f661c7610ee7e8
-
SSDEEP
768:JvaMmL4x3TNJsv3qbkm2QBXCO257Tg54OtsMtbwPqQ78/NoZzAa7D57ap85nVk+:FuokLr57TCHFwiQ78lolAa7tamk+
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2464 cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\kr_done1 bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2680 bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2464 2680 bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2464 2680 bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2464 2680 bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2464 2680 bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninstf76d27b.bat" "C:\Users\Admin\AppData\Local\Temp\bd3813b98ff4ea97d99deaf930e1b2a2_JaffaCakes118.exe""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59B
MD52988b921fbed03f9c93c5d538932bbe3
SHA14b791b3d59ae76ff091c2cf201b40f5d1b432a3f
SHA256a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3
SHA5122920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9