Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe
-
Size
348KB
-
MD5
c376bf2085e4a128138f9670a00238df
-
SHA1
a07d8e9154ab987d6ec086fe1998e765acca2e08
-
SHA256
49b88c44acd0ac95bdf30f02c4692e4e46010363fb5609278837a998819c02f4
-
SHA512
2483fab364e3d0f0df484dba14f7af75c3b429de168a835a7f75d0c41482accac8dd014b5901960ab39b5890bd359ac6fd9ae2d2bc2855fe1923bce56451745d
-
SSDEEP
3072:iBVIprHpt3UJUx8J8BlA4wgfrgT5iH0OBZgD+GkG8sp40aHP00Wm6E6lW7mf2gq+:iBqZzx8GXfETq3Bxesci6OjgqlQex8
Malware Config
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/628-15-0x0000000000300000-0x0000000000329000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe -
Loads dropped DLL 2 IoCs
pid Process 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe -
pid Process 2772 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2804 sc.exe 2680 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 2772 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2772 powershell.exe Token: SeTcbPrivilege 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 2764 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 30 PID 628 wrote to memory of 2764 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 30 PID 628 wrote to memory of 2764 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 30 PID 628 wrote to memory of 2764 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 30 PID 628 wrote to memory of 2316 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 31 PID 628 wrote to memory of 2316 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 31 PID 628 wrote to memory of 2316 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 31 PID 628 wrote to memory of 2316 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 31 PID 628 wrote to memory of 1692 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 33 PID 628 wrote to memory of 1692 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 33 PID 628 wrote to memory of 1692 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 33 PID 628 wrote to memory of 1692 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 33 PID 628 wrote to memory of 2916 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 36 PID 628 wrote to memory of 2916 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 36 PID 628 wrote to memory of 2916 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 36 PID 628 wrote to memory of 2916 628 c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe 36 PID 2316 wrote to memory of 2680 2316 cmd.exe 37 PID 2316 wrote to memory of 2680 2316 cmd.exe 37 PID 2316 wrote to memory of 2680 2316 cmd.exe 37 PID 2316 wrote to memory of 2680 2316 cmd.exe 37 PID 2764 wrote to memory of 2804 2764 cmd.exe 38 PID 2764 wrote to memory of 2804 2764 cmd.exe 38 PID 2764 wrote to memory of 2804 2764 cmd.exe 38 PID 2764 wrote to memory of 2804 2764 cmd.exe 38 PID 1692 wrote to memory of 2772 1692 cmd.exe 39 PID 1692 wrote to memory of 2772 1692 cmd.exe 39 PID 1692 wrote to memory of 2772 1692 cmd.exe 39 PID 1692 wrote to memory of 2772 1692 cmd.exe 39 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2916 wrote to memory of 3044 2916 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 40 PID 2724 wrote to memory of 2852 2724 taskeng.exe 42 PID 2724 wrote to memory of 2852 2724 taskeng.exe 42 PID 2724 wrote to memory of 2852 2724 taskeng.exe 42 PID 2724 wrote to memory of 2852 2724 taskeng.exe 42 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 PID 2852 wrote to memory of 676 2852 c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c376bf2085e4a128138f9670a00238df_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
-
C:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3044
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A60E60F2-B6C8-45E5-82CB-DE8D9511AC1E} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\WNetval\c387bf2096e4a129139f9780a00239df_KaffaDaket119.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:676
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
348KB
MD5c376bf2085e4a128138f9670a00238df
SHA1a07d8e9154ab987d6ec086fe1998e765acca2e08
SHA25649b88c44acd0ac95bdf30f02c4692e4e46010363fb5609278837a998819c02f4
SHA5122483fab364e3d0f0df484dba14f7af75c3b429de168a835a7f75d0c41482accac8dd014b5901960ab39b5890bd359ac6fd9ae2d2bc2855fe1923bce56451745d