Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 10:25
Static task
static1
Behavioral task
behavioral1
Sample
cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe
-
Size
436KB
-
MD5
cf549f81ef8bfeba297eb230402cabb9
-
SHA1
95585ea663229cb5491835fa818f8eae037dd988
-
SHA256
8844dc1c01389b6afb98dd7161a948550971c104d111927a3e28d84d0516fd78
-
SHA512
b9fed3cfea3d4ff2d73fdc1f682730a9c8314ce6bb0619a98eb632969cecaad056beb2f07b5d0d774fb9339f23783340be2575445312bb544de2d1375ab88d56
-
SSDEEP
6144:LcL/UN9E7bNGoe22ZYKD9nCuRQRHGJvy2wjlmRpsC182m87sUi:LCA9EvMoe22qKDSGJyURpsi9li
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2312 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2656 dcadbtjom.exe -
Loads dropped DLL 3 IoCs
pid Process 2312 cmd.exe 2312 cmd.exe 2656 dcadbtjom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcadbtjom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2312 cmd.exe 2332 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2840 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2332 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2840 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2312 2104 cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe 29 PID 2104 wrote to memory of 2312 2104 cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe 29 PID 2104 wrote to memory of 2312 2104 cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe 29 PID 2104 wrote to memory of 2312 2104 cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe 29 PID 2312 wrote to memory of 2840 2312 cmd.exe 31 PID 2312 wrote to memory of 2840 2312 cmd.exe 31 PID 2312 wrote to memory of 2840 2312 cmd.exe 31 PID 2312 wrote to memory of 2840 2312 cmd.exe 31 PID 2312 wrote to memory of 2332 2312 cmd.exe 33 PID 2312 wrote to memory of 2332 2312 cmd.exe 33 PID 2312 wrote to memory of 2332 2312 cmd.exe 33 PID 2312 wrote to memory of 2332 2312 cmd.exe 33 PID 2312 wrote to memory of 2656 2312 cmd.exe 34 PID 2312 wrote to memory of 2656 2312 cmd.exe 34 PID 2312 wrote to memory of 2656 2312 cmd.exe 34 PID 2312 wrote to memory of 2656 2312 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2104 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\cf549f81ef8bfeba297eb230402cabb9_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\DCADBT~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 21043⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2332
-
-
C:\Users\Admin\AppData\Local\dcadbtjom.exeC:\Users\Admin\AppData\Local\DCADBT~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5cf549f81ef8bfeba297eb230402cabb9
SHA195585ea663229cb5491835fa818f8eae037dd988
SHA2568844dc1c01389b6afb98dd7161a948550971c104d111927a3e28d84d0516fd78
SHA512b9fed3cfea3d4ff2d73fdc1f682730a9c8314ce6bb0619a98eb632969cecaad056beb2f07b5d0d774fb9339f23783340be2575445312bb544de2d1375ab88d56