Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe
-
Size
39KB
-
MD5
d6cf111bfb733f325666e8ccee041c7a
-
SHA1
62a2655d151418a7f42e8990d0d92d4e0b68c5b7
-
SHA256
e6b210664b8ccf719cd29ef0903fa5a4b8ee8f6069ab9a737fd25a2e0e8ee02a
-
SHA512
385bb1db7e8713dbeba23accc714dc5575d2210fd5f73bf7e46bae19ac39438d8873d3f628e6299e99b758eaa36209d3fa29abdef81787fdfb6d6c8212f0b106
-
SSDEEP
768:aT4wO+IkS0JAVnVibDMPbDLxdGRbn0/bwy/851xa1VNz4Z/Dft:mOXnVTjV5E521V6Z/x
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\ d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ virtscrl.exe -
Deletes itself 1 IoCs
pid Process 2112 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2072 virtscrl.exe -
Loads dropped DLL 2 IoCs
pid Process 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\virtscrl.exe d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\virtscrl.exe d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe File created C:\Windows\SysWOW64\virtscrl.exe virtscrl.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virtscrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2072 virtscrl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2072 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 30 PID 2068 wrote to memory of 2072 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 30 PID 2068 wrote to memory of 2072 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 30 PID 2068 wrote to memory of 2072 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 30 PID 2068 wrote to memory of 2112 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 31 PID 2068 wrote to memory of 2112 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 31 PID 2068 wrote to memory of 2112 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 31 PID 2068 wrote to memory of 2112 2068 d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe 31 PID 2072 wrote to memory of 2496 2072 virtscrl.exe 32 PID 2072 wrote to memory of 2496 2072 virtscrl.exe 32 PID 2072 wrote to memory of 2496 2072 virtscrl.exe 32 PID 2072 wrote to memory of 2496 2072 virtscrl.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d6cf111bfb733f325666e8ccee041c7a_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\virtscrl.exe"C:\Windows\system32\virtscrl.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\virtscrl.exe > nul3⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\D6CF11~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5d6cf111bfb733f325666e8ccee041c7a
SHA162a2655d151418a7f42e8990d0d92d4e0b68c5b7
SHA256e6b210664b8ccf719cd29ef0903fa5a4b8ee8f6069ab9a737fd25a2e0e8ee02a
SHA512385bb1db7e8713dbeba23accc714dc5575d2210fd5f73bf7e46bae19ac39438d8873d3f628e6299e99b758eaa36209d3fa29abdef81787fdfb6d6c8212f0b106