Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe
-
Size
315KB
-
MD5
c1d3eba84431214902d4c562999317e8
-
SHA1
888506300aebcd27ff1f4c60cd4cbbc2da7006cc
-
SHA256
03840f3e790cc87054fb2cedbe9599ea8ecd5627a845e31ec80ac09d6b279e3f
-
SHA512
55756420c0ac77ace4aa81add45a89197ae10504d09810a0512c391af57a6b11bddd6ab8fa321e9a9a22dd5ba3cae48f64fc96710a95b8ce6c374f8d62ecc1e8
-
SSDEEP
6144:j/m6Mh9mPutuTST7yiza7inj1VwPq3BnZGrM60IcEemaF0utMa:S69usromqRZG90IAQa
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2824 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2772 bfxxnzvd.exe -
Loads dropped DLL 3 IoCs
pid Process 2824 cmd.exe 2824 cmd.exe 2772 bfxxnzvd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfxxnzvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2824 cmd.exe 2896 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2700 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2896 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2700 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe 2772 bfxxnzvd.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2824 2684 c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2824 2684 c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2824 2684 c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2824 2684 c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe 30 PID 2824 wrote to memory of 2700 2824 cmd.exe 32 PID 2824 wrote to memory of 2700 2824 cmd.exe 32 PID 2824 wrote to memory of 2700 2824 cmd.exe 32 PID 2824 wrote to memory of 2700 2824 cmd.exe 32 PID 2824 wrote to memory of 2896 2824 cmd.exe 34 PID 2824 wrote to memory of 2896 2824 cmd.exe 34 PID 2824 wrote to memory of 2896 2824 cmd.exe 34 PID 2824 wrote to memory of 2896 2824 cmd.exe 34 PID 2824 wrote to memory of 2772 2824 cmd.exe 35 PID 2824 wrote to memory of 2772 2824 cmd.exe 35 PID 2824 wrote to memory of 2772 2824 cmd.exe 35 PID 2824 wrote to memory of 2772 2824 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2684 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\c1d3eba84431214902d4c562999317e8_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\bfxxnzvd.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 26843⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2896
-
-
C:\Users\Admin\AppData\Local\bfxxnzvd.exeC:\Users\Admin\AppData\Local\bfxxnzvd.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315KB
MD5c1d3eba84431214902d4c562999317e8
SHA1888506300aebcd27ff1f4c60cd4cbbc2da7006cc
SHA25603840f3e790cc87054fb2cedbe9599ea8ecd5627a845e31ec80ac09d6b279e3f
SHA51255756420c0ac77ace4aa81add45a89197ae10504d09810a0512c391af57a6b11bddd6ab8fa321e9a9a22dd5ba3cae48f64fc96710a95b8ce6c374f8d62ecc1e8