Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe
-
Size
290KB
-
MD5
dab27dfaa0f669314f57c94e188d2c33
-
SHA1
1ccd4c7f480b3f0b99b3cfff641c07e04c58431c
-
SHA256
0a91593630ec377b8c13974886147e7a7cc73f5cebbeb9f1758001c241e8ce0a
-
SHA512
28aa5034efc0f6588234b1080bb43a0f7effbba6b2415a5710ad5951cc3f3b43e3e762afd5e7f36a94fd7a2991de8458f26c97eea77274f9ceba1daa7084fb55
-
SSDEEP
6144:wXBlvdqWLqOKn/B5RyaynzgvGq6JhW7XQgtm0DT91n:wXB/zLG/B5YzFHEtmA
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1596 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2100 jeme.exe -
Loads dropped DLL 2 IoCs
pid Process 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D2BEAD48-3C80-AD4F-FE01-FCCCDCDBDFD1} = "C:\\Users\\Admin\\AppData\\Roaming\\Akyn\\jeme.exe" jeme.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1832 set thread context of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Privacy dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe 2100 jeme.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe Token: SeSecurityPrivilege 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe Token: SeSecurityPrivilege 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 2100 jeme.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2100 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 30 PID 1832 wrote to memory of 2100 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 30 PID 1832 wrote to memory of 2100 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 30 PID 1832 wrote to memory of 2100 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1064 2100 jeme.exe 18 PID 2100 wrote to memory of 1064 2100 jeme.exe 18 PID 2100 wrote to memory of 1064 2100 jeme.exe 18 PID 2100 wrote to memory of 1064 2100 jeme.exe 18 PID 2100 wrote to memory of 1064 2100 jeme.exe 18 PID 2100 wrote to memory of 1128 2100 jeme.exe 19 PID 2100 wrote to memory of 1128 2100 jeme.exe 19 PID 2100 wrote to memory of 1128 2100 jeme.exe 19 PID 2100 wrote to memory of 1128 2100 jeme.exe 19 PID 2100 wrote to memory of 1128 2100 jeme.exe 19 PID 2100 wrote to memory of 1156 2100 jeme.exe 20 PID 2100 wrote to memory of 1156 2100 jeme.exe 20 PID 2100 wrote to memory of 1156 2100 jeme.exe 20 PID 2100 wrote to memory of 1156 2100 jeme.exe 20 PID 2100 wrote to memory of 1156 2100 jeme.exe 20 PID 2100 wrote to memory of 1876 2100 jeme.exe 25 PID 2100 wrote to memory of 1876 2100 jeme.exe 25 PID 2100 wrote to memory of 1876 2100 jeme.exe 25 PID 2100 wrote to memory of 1876 2100 jeme.exe 25 PID 2100 wrote to memory of 1876 2100 jeme.exe 25 PID 2100 wrote to memory of 1832 2100 jeme.exe 29 PID 2100 wrote to memory of 1832 2100 jeme.exe 29 PID 2100 wrote to memory of 1832 2100 jeme.exe 29 PID 2100 wrote to memory of 1832 2100 jeme.exe 29 PID 2100 wrote to memory of 1832 2100 jeme.exe 29 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31 PID 1832 wrote to memory of 1596 1832 dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe 31
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1064
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1128
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dab27dfaa0f669314f57c94e188d2c33_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Roaming\Akyn\jeme.exe"C:\Users\Admin\AppData\Roaming\Akyn\jeme.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2100
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp54727ac9.bat"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1596
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271B
MD5a2f10c3f25d6f7225440da34b66163c0
SHA196262ec178fecfc239f355eaf5ec52e428cb59c7
SHA256cc2226e0e639ce6d1959b6075f431af4838ef35651bde0e826d355af254ded3b
SHA512fb610ba8a499d9f09830dd7b0d825102747d8dfeb16b00125b7214f0010270753e183b2766d86a08a89e2dc421fd6088e1fb26905bdfb14f8be2b1b54cf2eab1
-
Filesize
290KB
MD5a11af48edd8aec69a68808c7f4b97e1a
SHA1e441c3378afa821d2821593071e0c61020492bf9
SHA256718da308d5568be48d8ac316333404d3eec702858c259724a14dcdd41a2f6bd1
SHA5125953dfef4fce51b09a5b83849d2ea3873b3e6cef9d4c32adbaa2c945ba39872ed72c2982b6041ad515e1ea0b7af2d6b2f19cb6fa923fb43a03a25fba29c702c2
-
Filesize
380B
MD577ae6edbe1e82ec6569043b25f3bdab9
SHA1a290adf2dbdbe5ec936ec3f5fad45a77d1e8d58b
SHA2564e1f6abb9c368af531c499d5129a1319fcf395b646563f994525d0720496d4f1
SHA512b587bdd024c237858e4eb68a144ca30f94af4d9a8455d770dcf31034984f7449ea738e0c645f8ec6aed442c0ad9f02782fe9ba712e218b8947222b03aa4e901e