Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 21:35
Behavioral task
behavioral1
Sample
bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe
-
Size
784KB
-
MD5
bd3e3d2727ba5a17d14498b17bb4378a
-
SHA1
fb34955e3bf2044a9ebe07d46262e0d4f2af8235
-
SHA256
cb2946d049291d2da4abf3d6b98307c541b9856a5cc045d4bc4b5980e80d7baf
-
SHA512
93ab18345e309bb092deab3f2d41b3b40e7305dcb9a0481d2e7eb0edd370fe0383e37279ca7f56f074bea70cff5c39d4f4804e308ffa740d01192a8905b4f640
-
SSDEEP
24576:gk3kfzoHCxAasiQ04qMbiSjqPtJO2J+L:gk3k7oGVWjbiSe+2YL
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral1/memory/3016-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/3016-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2680-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2680-27-0x0000000003060000-0x00000000031F3000-memory.dmp xmrig behavioral1/memory/2680-19-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2680-34-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/2680-35-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2680 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2680 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/3016-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x00070000000120fe-10.dat upx behavioral1/memory/2680-17-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/3016-15-0x0000000003290000-0x00000000035A2000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe 2680 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2680 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe 31 PID 3016 wrote to memory of 2680 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe 31 PID 3016 wrote to memory of 2680 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe 31 PID 3016 wrote to memory of 2680 3016 bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\bd3e3d2727ba5a17d14498b17bb4378a_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD56d2c6e24667ebd4d3f84a9202efae9b4
SHA1afc6108c8a67e96bbe192dedc4cea160237252bd
SHA2566bca7ec2bd6b562a1ba4f221713ac687853fe1c7d73dd816ee8743bb148140d5
SHA5127df1e1ca05e1e438b7d7f1b3375e6ed250dbf173085f7fa5a44a8f39f3754bb217fb0a025883877c662952996c0be4c952ce68c29a935453faf62d523fe22e88