Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe
-
Size
23KB
-
MD5
bb28237e9ea4ac920c5356d9ae597096
-
SHA1
b0c80ddcba2c39b1b682f6180727546f2077b3dd
-
SHA256
fa1a227c4d3304257b1926d3a59e8c628a8b20f77743212f99fd24389904c582
-
SHA512
b73cfe194297bbd5d1dba42581cde197f050c2dbf982f96cc30c5edd2f4ef667a288ad33e129b979bdb259eca8a700e2dccb7421890db8577a2cca0c362128e1
-
SSDEEP
384:EkI9t83dWdHctAZT8SlZz4KhZrtGR5WAPAo:EkYt8tW+tAZTrTTtGRMAP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1916 EhhKGkcgg -
Loads dropped DLL 2 IoCs
pid Process 2264 bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe 2264 bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x000b000000012281-2.dat upx behavioral1/memory/1916-11-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/1916-16-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows installer = "C:\\winstall.exe" EhhKGkcgg -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EhhKGkcgg -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg 1916 EhhKGkcgg -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 1916 2264 bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe 31 PID 2264 wrote to memory of 1916 2264 bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe 31 PID 2264 wrote to memory of 1916 2264 bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe 31 PID 2264 wrote to memory of 1916 2264 bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bb28237e9ea4ac920c5356d9ae597096_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\EhhKGkcggC:\Users\Admin\AppData\Local\Temp\EhhKGkcgg2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD553122f8a4c525dac6b907e2a35b4f6f6
SHA146a398df28e851a77eff68856a9c52210167582e
SHA25608a232ec9738ff249d60a0a72f6eb0fb8e5e40b178e7792ad2d832383e6f865e
SHA51278d547a9b9ff59bdac17e0d8bd44c16f4ada41b2696f42c5ecaba7c7cde41cd5f0bc4e35f8f96d58d4321e5350f4d7441708dffd0c00b7416b34a8e426993648