Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 21:05
Static task
static1
Behavioral task
behavioral1
Sample
c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe
-
Size
3.5MB
-
MD5
c7a676e984bf992c01ad18fb6ed7b289
-
SHA1
af59d490c8247d0bcc6892d424318f2e787ef73f
-
SHA256
f63c4e0a8946c15ba8d8343c0265cc483ffe9cdb0e62a996a1f995e57e4f9f52
-
SHA512
c33032037698151ced330ba55c0a449d7b492bed8d853a457a01c746c12404e2b416ba3c737d9f2875d187b2e158ea45eb84c9d1d79a8a76e666934581713c12
-
SSDEEP
49152:0a1ISQus8/2Ge/5mMk1HvWpcnscVyCDxl4KZKWCbquSVex1yrZO70r:/1ISQusLGKmMaHgcn+gxPKWCbMs1Gt
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tazebama.dl_ -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tazebama.dl_ -
Executes dropped EXE 1 IoCs
pid Process 2740 tazebama.dl_ -
Loads dropped DLL 3 IoCs
pid Process 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: tazebama.dl_ File opened (read-only) \??\R: tazebama.dl_ File opened (read-only) \??\O: tazebama.dl_ File opened (read-only) \??\M: tazebama.dl_ File opened (read-only) \??\L: tazebama.dl_ File opened (read-only) \??\X: tazebama.dl_ File opened (read-only) \??\U: tazebama.dl_ File opened (read-only) \??\T: tazebama.dl_ File opened (read-only) \??\I: tazebama.dl_ File opened (read-only) \??\K: tazebama.dl_ File opened (read-only) \??\J: tazebama.dl_ File opened (read-only) \??\E: tazebama.dl_ File opened (read-only) \??\Y: tazebama.dl_ File opened (read-only) \??\W: tazebama.dl_ File opened (read-only) \??\N: tazebama.dl_ File opened (read-only) \??\G: tazebama.dl_ File opened (read-only) \??\Z: tazebama.dl_ File opened (read-only) \??\P: tazebama.dl_ File opened (read-only) \??\H: tazebama.dl_ File opened (read-only) \??\V: tazebama.dl_ File opened (read-only) \??\Q: tazebama.dl_ -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf tazebama.dl_ File opened for modification C:\autorun.inf tazebama.dl_ File opened for modification C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf tazebama.dl_ -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE tazebama.dl_ -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tazebama.dl_ -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2740 tazebama.dl_ -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2740 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe 30 PID 2228 wrote to memory of 2740 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe 30 PID 2228 wrote to memory of 2740 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe 30 PID 2228 wrote to memory of 2740 2228 c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7a676e984bf992c01ad18fb6ed7b289_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
157KB
MD591ad3f73942ec729b2bd0ec957065c71
SHA126aa7edc43424bb11c439b4879ada78d616b261a
SHA2564af21f4995d475c85028cd76585656d3e17a295326b496fd64d17f85b9aa0bd8
SHA512a8df716d5572a7d79628d6b8088da79437816f37d790dacea6d4c7717aa447ecacc39be9e9b03d6663882b03da0972238ce5edc93e7f4d1505287a8f859908b9
-
Filesize
69KB
MD58ba404e90194c38541e324657e72f74c
SHA1ad9fda28f95b7747579a7fbb8a18e1d1e6311a49
SHA2568145e4c62390f9c55343cc6dadb790dc2cb9463c4f578fa57bf43f12c4720340
SHA5121f594ebb6b970c9cb86b97d642351106a52db407c6e90db7391b50e97a1136e5ba13aeec66c9b985192c377d8c5c70d3746a00f37bcc83855fea316cf8d82362
-
Filesize
77KB
MD520d43f8bbb2169613263579815f2999e
SHA10a8d9a8b166cb0b1f461124cd2f44487ea990ba0
SHA256b17f2664d0fdb735828d542ea27073740d961f6f697cc9953875588039a0ad3a
SHA512c21e3f582355f6c5150c0993d5f30bf503128b8ac68e609d4674528b7dfba365fda00deb860cc6c03b7846763fdcc963c84945a3440f2eb25b68d3388ceec35f
-
Filesize
157KB
MD5c8fb29b7a331b6c66f995bfe95ef59bd
SHA1127bd2086f648f53a9a926171bcf106f2ac25cce
SHA2568426834717872b0f5344f4f895a26880c69d260a7057de91e0334c0b05aae725
SHA5122e68ef1170f504451d2138228535a87102d417f59d398d1c26cce2962ae5e195133adf6ff1edfdf12b9f07c7dee58df5c47cb6873e52896fe98c62675c8ea136
-
Filesize
157KB
MD54c5406f905ce7f5662a2b698188ee56a
SHA13409d80da034c3efa426692f7ee7d7b7f7c06955
SHA2565bce523ac1ba8f94ef2a7f13409b3b5962eddaf9d5a4778b9f6f5e7829dd11a6
SHA51206ea515c45e5400bb064c0b1cd4899abe3dcdeca5e8d4755287daab8a0e2374f5bad53d6e6ae0eeb57c691620e01e4e541e7cff3c25274a465c40ef17db2d336
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c