Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 09:53
Behavioral task
behavioral1
Sample
dc2db3d67ea5ce99d788d2028947d68b_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dc2db3d67ea5ce99d788d2028947d68b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
201153135239.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
201153135239.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
20115313521.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
20115313521.exe
Resource
win10v2004-20240802-en
General
-
Target
201153135239.exe
-
Size
25.2MB
-
MD5
57f0f15ef829fa03fecf784d5c658bae
-
SHA1
1d86700c8c555df352c2922d02da686825525c00
-
SHA256
ddb52e15b7891d1aded1312934d2e6f620c08e1f0e0da77ab3b68343daef7560
-
SHA512
22fa2b29066c2a638f393cb2f99316f3786351c805a6bc3a41f2cc8b5ba681954167ba08cb4d5930fc8e5caf4c70ceadbfdd092e0511a568abb47466acbb526b
-
SSDEEP
3072:ALk395hYXJS1VNR0FtDZU4JPK76fcqIVw4Z8KZSrXC4VQipg2vub:AQqY30Fn9PdcqIVwE8Wxidub
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2592 20115313521.exe -
Loads dropped DLL 5 IoCs
pid Process 2220 201153135239.exe 2220 201153135239.exe 2592 20115313521.exe 2592 20115313521.exe 2592 20115313521.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ball = "C:\\WINDOWS\\Ball.exe" 20115313521.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\Ball.exe 20115313521.exe File opened for modification C:\WINDOWS\Ball.exe 20115313521.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 201153135239.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20115313521.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2592 20115313521.exe 2592 20115313521.exe 2592 20115313521.exe 2592 20115313521.exe 2592 20115313521.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2592 20115313521.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2592 2220 201153135239.exe 30 PID 2220 wrote to memory of 2592 2220 201153135239.exe 30 PID 2220 wrote to memory of 2592 2220 201153135239.exe 30 PID 2220 wrote to memory of 2592 2220 201153135239.exe 30 PID 2220 wrote to memory of 2592 2220 201153135239.exe 30 PID 2220 wrote to memory of 2592 2220 201153135239.exe 30 PID 2220 wrote to memory of 2592 2220 201153135239.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\201153135239.exe"C:\Users\Admin\AppData\Local\Temp\201153135239.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\temp\20115313521.exe"C:\Windows\temp\20115313521.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592
-