Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe
-
Size
292KB
-
MD5
be348e50823c8a2e7c15a5829928c8ec
-
SHA1
1b054099d72e9ed9611cc1a33c0d3a0c3cf695da
-
SHA256
4c553e61a1f703e8b62beb72128855c4ea73dd3586dbabcef595a40c6497b47f
-
SHA512
8c54282c50716fe00cadc2532c5f91ba49a07b165c0be2adaa61bd05e1d7f873e55c27c370c3610abe72f551e5d0b6fdd114712f6c18acc1866b715bafa25d6c
-
SSDEEP
6144:qoBD6iz9BBwwPCM9MeaOsCSP26Vh9BgODLlV98io3PXlB25LtP71cYUG/bo:qoGTI33765BgCLl3u3PXTyZxcYHj
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2840 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2608 jdygu.exe -
Loads dropped DLL 3 IoCs
pid Process 2840 cmd.exe 2840 cmd.exe 2608 jdygu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdygu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3024 PING.EXE 2840 cmd.exe -
Kills process with taskkill 1 IoCs
pid Process 2900 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3024 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2900 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2840 2344 be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2840 2344 be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2840 2344 be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2840 2344 be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe 30 PID 2840 wrote to memory of 2900 2840 cmd.exe 32 PID 2840 wrote to memory of 2900 2840 cmd.exe 32 PID 2840 wrote to memory of 2900 2840 cmd.exe 32 PID 2840 wrote to memory of 2900 2840 cmd.exe 32 PID 2840 wrote to memory of 3024 2840 cmd.exe 34 PID 2840 wrote to memory of 3024 2840 cmd.exe 34 PID 2840 wrote to memory of 3024 2840 cmd.exe 34 PID 2840 wrote to memory of 3024 2840 cmd.exe 34 PID 2840 wrote to memory of 2608 2840 cmd.exe 35 PID 2840 wrote to memory of 2608 2840 cmd.exe 35 PID 2840 wrote to memory of 2608 2840 cmd.exe 35 PID 2840 wrote to memory of 2608 2840 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2344 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\be348e50823c8a2e7c15a5829928c8ec_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\jdygu.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 23443⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3024
-
-
C:\Users\Admin\AppData\Local\jdygu.exeC:\Users\Admin\AppData\Local\jdygu.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
MD5be348e50823c8a2e7c15a5829928c8ec
SHA11b054099d72e9ed9611cc1a33c0d3a0c3cf695da
SHA2564c553e61a1f703e8b62beb72128855c4ea73dd3586dbabcef595a40c6497b47f
SHA5128c54282c50716fe00cadc2532c5f91ba49a07b165c0be2adaa61bd05e1d7f873e55c27c370c3610abe72f551e5d0b6fdd114712f6c18acc1866b715bafa25d6c