Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe
-
Size
55KB
-
MD5
b9a81478c33603bd3b8154ace1dec634
-
SHA1
3a1409a7ceca2c69fd7a356728d10817ed23245f
-
SHA256
b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d
-
SHA512
8b7d9bae301cce42b34cdfc677934b43c6f93717b3a6770d4a07bc9d2bc7e775f1bf2cfe78e1d3b36bef05690fb35039da63312210ca24e4d96a5842fd6843b0
-
SSDEEP
768:Wc648rcDTCuajJ366d1S+lQFvv1YoOMNgbZpuNMrY7JsaeIwDJ8UJJk:WHuajJ366fcYoEtObeaIU
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\dumprepk MSCONFIG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\dumprepk\StubPath = "C:\\Windows\\MSCONFIG.exe" MSCONFIG.exe -
Deletes itself 1 IoCs
pid Process 2464 cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 2696 B9A814~1.EXE 2112 MSCONFIG.exe 2820 MSCONFIG.exe -
Loads dropped DLL 2 IoCs
pid Process 2464 cmd.exe 2464 cmd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\w32_systm.exe b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe File created C:\Windows\w32_sysbm.bat b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe File created C:\Windows\MSCONFIG.exe B9A814~1.EXE File opened for modification C:\Windows\MSCONFIG.exe B9A814~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2968 2820 WerFault.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A814~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSCONFIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSCONFIG.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2696 B9A814~1.EXE 2112 MSCONFIG.exe 2820 MSCONFIG.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2820 MSCONFIG.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2464 3004 b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe 29 PID 3004 wrote to memory of 2464 3004 b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe 29 PID 3004 wrote to memory of 2464 3004 b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe 29 PID 3004 wrote to memory of 2464 3004 b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe 29 PID 2464 wrote to memory of 2696 2464 cmd.exe 31 PID 2464 wrote to memory of 2696 2464 cmd.exe 31 PID 2464 wrote to memory of 2696 2464 cmd.exe 31 PID 2464 wrote to memory of 2696 2464 cmd.exe 31 PID 2696 wrote to memory of 2112 2696 B9A814~1.EXE 32 PID 2696 wrote to memory of 2112 2696 B9A814~1.EXE 32 PID 2696 wrote to memory of 2112 2696 B9A814~1.EXE 32 PID 2696 wrote to memory of 2112 2696 B9A814~1.EXE 32 PID 2112 wrote to memory of 2820 2112 MSCONFIG.exe 33 PID 2112 wrote to memory of 2820 2112 MSCONFIG.exe 33 PID 2112 wrote to memory of 2820 2112 MSCONFIG.exe 33 PID 2112 wrote to memory of 2820 2112 MSCONFIG.exe 33 PID 2820 wrote to memory of 2968 2820 MSCONFIG.exe 34 PID 2820 wrote to memory of 2968 2820 MSCONFIG.exe 34 PID 2820 wrote to memory of 2968 2820 MSCONFIG.exe 34 PID 2820 wrote to memory of 2968 2820 MSCONFIG.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9a81478c33603bd3b8154ace1dec634_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Windows\w32_sysbm.bat" "2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\B9A814~1.EXEC:\Users\Admin\AppData\Local\Temp\B9A814~1.EXE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\MSCONFIG.exe"C:\Windows\MSCONFIG.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\MSCONFIG.exe"C:\Windows\MSCONFIG.exe" stm5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1606⤵
- Program crash
PID:2968
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5fb2c65a9bf6dfc2255229aa5aa2e8995
SHA111d09bff6fba5537e7e7fb575a33544aadfa2cb8
SHA2562ca7d85d41ae077a36533c0498c9a7a167c5bba5f167bb95d847803e2ad0efd7
SHA512237d63684d08709911b64b20cffb38cd56c7c7c14fc497341b96fe9e647ffdf9d1124a78f2f3423dd4ec5b8adf8b40240fc65b2397efafde79333777724515b0
-
Filesize
52KB
MD5b010589209f3ac3e9f907ae492cd4974
SHA1804ddd8c7a940b602b9b616ee85e0796c4cbb098
SHA256a94cbb3cf46ed985a6de6c5705b9dd8365bd1969bc8c8605617d38ccdfe56c94
SHA5129b011437889fd6c489d62ae0483eca56646b112cf86232294ed9f5bf90910b47dc1efe5fb7867c7ddaa53820bb194d47a61faf89f1e69fad4d576da944a613b6