Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe
-
Size
348KB
-
MD5
cf28f3d39fd78d020df13df413696d19
-
SHA1
4f4a343ef2e46481183795b3b2c6a3a1a0f65e20
-
SHA256
47d6addd48e4d3075d98ef0852591dc95020f76355a437622c0598a2767dd81c
-
SHA512
68672ca7402bddff708656a34d34514dcbc06656dc1413307beaa6e635ff0ea89967c28237427eea1d51040b8c7add86c5c575136b2020aedaba178ac70e3904
-
SSDEEP
6144:jf88mV0bMZUby0d33/UsfV166Q8YEy6mCegOXRcVjSTVA1lLMF:DbU0bMuR3BfjXBNYgOX6VWTqfoF
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146944" JOib3Mu89WItPI.exe -
resource yara_rule behavioral1/memory/2584-1-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/540-4-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/540-5-0x0000000000400000-0x00000000004D8000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\JOib3Mu89WItPI JOib3Mu89WItPI.exe File opened for modification C:\PROGRA~3\JOib3Mu89WItPI JOib3Mu89WItPI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOib3Mu89WItPI.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main JOib3Mu89WItPI.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" JOib3Mu89WItPI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 540 JOib3Mu89WItPI.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2584 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 540 JOib3Mu89WItPI.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2584 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe 540 JOib3Mu89WItPI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2584 wrote to memory of 540 2584 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 31 PID 2584 wrote to memory of 540 2584 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 31 PID 2584 wrote to memory of 540 2584 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 31 PID 2584 wrote to memory of 540 2584 cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf28f3d39fd78d020df13df413696d19_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\PROGRA~3\JOib3Mu89WItPI.exeC:\PROGRA~3\JOib3Mu89WItPI.exe2⤵
- Manipulates Digital Signatures
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:540
-