Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe
-
Size
37KB
-
MD5
cf4884c260d6dba1b262b2305662593c
-
SHA1
c971bc4645d82caebc10b4a7ef5f9676ba7cf63c
-
SHA256
af3bf898da5864f374d850aef31b79987b3cf53f8e2705dad7e05dfefaeb787a
-
SHA512
3a6fbe2a8f67164e7bea045511c0eb600b77f0a7b7e2f38a2df862ae4a4485a72d3be643aa35c4e99afec4f16e35dc3382ef6829bac86a4e59335f8cfc509d4d
-
SSDEEP
768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMyw:edILlknNU4rOobbLynw
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1032 BCSSync.exe 2228 BCSSync.exe -
Loads dropped DLL 3 IoCs
pid Process 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 1032 BCSSync.exe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 Destination IP 83.133.119.139 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2260 set thread context of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 1032 set thread context of 2228 1032 BCSSync.exe 33 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSSync .exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2260 wrote to memory of 2480 2260 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 30 PID 2480 wrote to memory of 1032 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 32 PID 2480 wrote to memory of 1032 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 32 PID 2480 wrote to memory of 1032 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 32 PID 2480 wrote to memory of 1032 2480 cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe 32 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 1032 wrote to memory of 2228 1032 BCSSync.exe 33 PID 2228 wrote to memory of 2628 2228 BCSSync.exe 34 PID 2228 wrote to memory of 2628 2228 BCSSync.exe 34 PID 2228 wrote to memory of 2628 2228 BCSSync.exe 34 PID 2228 wrote to memory of 2628 2228 BCSSync.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\cf4884c260d6dba1b262b2305662593c_JaffaCakes118.exe5⤵
- System Location Discovery: System Language Discovery
PID:2628
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5ab646abfd145424bbd739bda12562e52
SHA10b0c38ddd0b786aa53abcb5df7c5cb7e39bb2b6d
SHA256f932d46ed959d2e3a61b99f95ed6d535b3cc2dd5e94618c68312a921f545b242
SHA5120c61eeb47bc81783a5239d1fc66211bb6a1733452236fdcfe08176b7da9465d05e5645e67162a0cf91f8b9b623e99bc8850b2c3012f8c581da6ce3d74ff14b47