Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe
-
Size
34KB
-
MD5
c76fd15a1394fd5d0b18ab079a21a2d0
-
SHA1
f0f00cc5b1474452aa0a0285b97c1c4b179274d2
-
SHA256
48fbea9afd9096bde569d8a2bad09779e04ddd7062e548be7f2bb45a18482d68
-
SHA512
efd408c3094216deeb138c9c1c947dc76cf54acf2c509561eb2db09bc17be4885ad1b12022162fbcd1de85391270a2f9549da0ebeb20176261edc00f03fc350a
-
SSDEEP
768:cflivXrVKpVhKvtxwYHwVFoeAQPmucwUU/b:ylqrVKprVuQPf
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2816 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2692 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe 2692 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\1c9fdb66\jusched.exe c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe File created C:\Program Files (x86)\1c9fdb66\1c9fdb66 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe 2816 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2816 2692 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2816 2692 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2816 2692 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2816 2692 c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c76fd15a1394fd5d0b18ab079a21a2d0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\1c9fdb66\jusched.exe"C:\Program Files (x86)\1c9fdb66\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
35KB
MD5fc3595a11b142f7f6b49e30870984b78
SHA139115efa1cd5cffce9f2908dc1bd32be88abd2be
SHA2564536512aef4a9ae0fd399808ce6d4a88ad4e9e061ba1e14b9e1e04ee1a227b92
SHA512c859f7b2381ab1202f5eaaa1c5774cfe10636b2182c856d03ed3e8dc9b3e7fb15b1a2f2ec9a07d138dc8d640ce3da9d9e21a7497ce4d457b365cad4aa95f2b8d