Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe
-
Size
364KB
-
MD5
ce2acdfb099d03ca2d628bf4fde7af77
-
SHA1
57e98da2bfba556260fafee21337d8d89bbf7000
-
SHA256
d8f027de01d835c1ebc363a2465fc2642658504b5383745848753ca8c5ba1fba
-
SHA512
2f2dfd841b94bf51e10c4cbd66a750b293e2635fa78886d0024e39f75eb82e27dc1736c4f5664553b2719d6919dde5b3645c24f9dc27f9b8759e23a266355f2e
-
SSDEEP
6144:ibCdhkyzFFbIX0zE9NKFEWNFfK4CS0NwIg2+fFBFFrkiEw:imdKWbIXxcXNkjNgZf1Fr5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2628 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2792 enab.exe -
Loads dropped DLL 2 IoCs
pid Process 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\{ED60B7C8-3C80-AD4F-2955-D827011AFB3A} = "C:\\Users\\Admin\\AppData\\Roaming\\Juvyw\\enab.exe" enab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1364 set thread context of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language enab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Privacy ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe 2792 enab.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 2792 enab.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2792 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 30 PID 1364 wrote to memory of 2792 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 30 PID 1364 wrote to memory of 2792 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 30 PID 1364 wrote to memory of 2792 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 30 PID 2792 wrote to memory of 1120 2792 enab.exe 19 PID 2792 wrote to memory of 1120 2792 enab.exe 19 PID 2792 wrote to memory of 1120 2792 enab.exe 19 PID 2792 wrote to memory of 1120 2792 enab.exe 19 PID 2792 wrote to memory of 1120 2792 enab.exe 19 PID 2792 wrote to memory of 1192 2792 enab.exe 20 PID 2792 wrote to memory of 1192 2792 enab.exe 20 PID 2792 wrote to memory of 1192 2792 enab.exe 20 PID 2792 wrote to memory of 1192 2792 enab.exe 20 PID 2792 wrote to memory of 1192 2792 enab.exe 20 PID 2792 wrote to memory of 1252 2792 enab.exe 21 PID 2792 wrote to memory of 1252 2792 enab.exe 21 PID 2792 wrote to memory of 1252 2792 enab.exe 21 PID 2792 wrote to memory of 1252 2792 enab.exe 21 PID 2792 wrote to memory of 1252 2792 enab.exe 21 PID 2792 wrote to memory of 1612 2792 enab.exe 25 PID 2792 wrote to memory of 1612 2792 enab.exe 25 PID 2792 wrote to memory of 1612 2792 enab.exe 25 PID 2792 wrote to memory of 1612 2792 enab.exe 25 PID 2792 wrote to memory of 1612 2792 enab.exe 25 PID 2792 wrote to memory of 1364 2792 enab.exe 29 PID 2792 wrote to memory of 1364 2792 enab.exe 29 PID 2792 wrote to memory of 1364 2792 enab.exe 29 PID 2792 wrote to memory of 1364 2792 enab.exe 29 PID 2792 wrote to memory of 1364 2792 enab.exe 29 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31 PID 1364 wrote to memory of 2628 1364 ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe 31
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce2acdfb099d03ca2d628bf4fde7af77_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Roaming\Juvyw\enab.exe"C:\Users\Admin\AppData\Roaming\Juvyw\enab.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2792
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp61c4be07.bat"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2628
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271B
MD550bbc72b7b3d18ba777c5119a31228fe
SHA139960342032ce247e20d7521b87e00adc6856a50
SHA2560fe8cd343450e96a46b4b3cd6d0fea1f9bb5924dd6f870bd76f073cf7a7251ac
SHA512c2f3f60efeac62b11bc15313841972553f18b23dace539844507457d94b519f31525b66c4bc3cdb1e2b5edefb8c6286c0d05bd2d88e87f7d19688d287426f52f
-
Filesize
364KB
MD53bf4dda0c2e108e1429fb377c608ae5a
SHA1f3f4c3a902b9ab52cf10ddd62aca02a814af5d47
SHA256bd1b59357b60464cbe11c53bba78a95dfc9e4c1d7d598f459cfcc40e78397ee9
SHA5124af30f06ea5904133042d8b98809113cefe9aad7c331a8f87b328fd267923419fd5b63d9a1db5272e69d38815359fee9865d76f248e9b25c9ee7c11f0aac6184