Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe
-
Size
168KB
-
MD5
dc3972c33695c275ef2d46e8ca6bac6b
-
SHA1
d21fd1ccd03d32ea935ff46e6ec6c02bd2af3006
-
SHA256
b57f37c359c50c19f8d29999a989f9cca27a5e4c8cbd646722391813ded5d87e
-
SHA512
cc3211f0a8549624bead68b741896878d4d257a9057c3674364feed58d56c42e9259bc962f3b94affa9ac96f11aee7932e9e1e1001b9d7249849bf03d91acecd
-
SSDEEP
3072:H1N1vsLAEKLHyy4xZttFXmFuBwEdy1N5ie7MVoMJVoJsevSTEkLdkJZdIGdYOMD:1sLAEaHyygZJlBNyjBMqMJB0SQ4kJZd6
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2304 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 332 csrss.exe -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2740 set thread context of 2304 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 332 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe Token: SeDebugPrivilege 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1200 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 21 PID 2740 wrote to memory of 332 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 2 PID 332 wrote to memory of 624 332 csrss.exe 30 PID 332 wrote to memory of 624 332 csrss.exe 30 PID 2740 wrote to memory of 2304 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 31 PID 2740 wrote to memory of 2304 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 31 PID 2740 wrote to memory of 2304 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 31 PID 2740 wrote to memory of 2304 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 31 PID 2740 wrote to memory of 2304 2740 dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe 31 PID 332 wrote to memory of 844 332 csrss.exe 13
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:844
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:624
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc3972c33695c275ef2d46e8ca6bac6b_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2304
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
2KB
MD560a7af3867a098bb70e2d7c367b30760
SHA1953d7fb9cec5b77a618d1179039849a2eee7767d
SHA256503116b6b5895e0560529f4a0a1896bfd3ce89a8a04a461fd2d8f2a141d487a8
SHA5126c607cc99eab5d22acf37b5fcc25804e2de84ea4b4efdf49659fbfc33a1aba73c0a98fbd18f43f2d343a24cfb48c9c637b07e007fa6798bc042d4616529a7032