Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 02:35
Behavioral task
behavioral1
Sample
dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe
-
Size
18KB
-
MD5
dba938da217e84374b4328240ddf9af5
-
SHA1
ba41ad9236e2155177201fb33bc13628988e1799
-
SHA256
acca2af7e073b279dbafb4e4e893518c78bbcb7da8290608e5103f6f953978ce
-
SHA512
f72b2d8e845972495f5ebe5b6c4a055832405c527841b1ee68e685a2cc3175037a136ee729142c2c2c2978e9e22815d08f0abd5589a5ee661c661d894898864a
-
SSDEEP
384:Ld6gB3AOzuO106w8+lOq718ulyrjbXfPcxcxQGdFn0RB5:hWOKpoj01mLkOQG30RB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2752 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1724 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1724-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1724-12-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\hkb0622a101.dll dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC0ACA58-6A6F-51DA-9EFE-9D20F4F611BA}\ dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{BC0ACA58-6A6F-51DA-9EFE-9D20F4F611BA}\\InProcServer32 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC0ACA58-6A6F-51DA-9EFE-9D20F4F611BA} dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC0ACA58-6A6F-51DA-9EFE-9D20F4F611BA}\InProcServer32 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC0ACA58-6A6F-51DA-9EFE-9D20F4F611BA}\InProcServer32\ = "C:\\Windows\\SysWow64\\hkb0622a101.dll" dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC0ACA58-6A6F-51DA-9EFE-9D20F4F611BA}\InProcServer32\ThreadingModel = "Apartment" dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\ dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1724 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2752 1724 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2752 1724 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2752 1724 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe 30 PID 1724 wrote to memory of 2752 1724 dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dba938da217e84374b4328240ddf9af5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.execmd /c self.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211B
MD5afcfed044314c67385232dee9d3b68cc
SHA12d2a38f8573d54354fe3dd22330d0b5f250cb9ff
SHA256a88df36741aca04695b79c7e055e847a12d2b76b232521bb9b571fc1929a55b1
SHA512828bbd894015630a5f325c358e5ac3dd8ecfb5c76c05c805aaffeb74dfc870e95fca9bb195c92422a474aae0359a6883caf74a6720d6332985d840994bb88a85
-
Filesize
32KB
MD55fa02caa08274399b25e473c554a2165
SHA1aef27f2f7cf44ecd812025a8ca4632cf9f55e5bb
SHA2564a9c3b737eb782834c037865d07c013dcbfcfebc436e40c772db97f14504e4fe
SHA51237c9f6ea6a7c8afd76f1b4ed000277f4a72d02f76b568ef4a715fa1b16f970dd9a99d9cc86325b06a16a719fb227156c51a86512ae73a79feffaaea5e4bfec68