Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
df815d13a8c5804d6f3f43b16390d9e4
-
SHA1
8e804769a245b28b22af42b225a5bf1949eea52b
-
SHA256
5cc477a5fa3fbc22c8f0fc8e86ac999de8fd7308223925d0a712eaedd8fe37b2
-
SHA512
d38b4da21e0ee8f155c4883aaafb8816c28f7b9387232ae60786900cb60cb9a214ae6cf312779f9ee98b4b7c9ef77ee3f45eab786fade38340a4940eaf0add91
-
SSDEEP
49152:v2tjrwtaghVJXh5kZ+0opZavj+cCQwmFjSEjDaV:ut/qai/a7+zQw6w
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2188 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp -
Loads dropped DLL 4 IoCs
pid Process 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 2188 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp 2188 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp 2188 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2188 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30 PID 1868 wrote to memory of 2188 1868 df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\is-ACPHJ.tmp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-ACPHJ.tmp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.tmp" /SL5="$400BE,1414789,53248,C:\Users\Admin\AppData\Local\Temp\df815d13a8c5804d6f3f43b16390d9e4_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD599f6101143e183bd54587095f775658a
SHA1b4137e88fbf26d790bd98a3a81c9da5f170a4f6b
SHA2563475cc5c9b0ebbae27023b55f21ba8e11e84d32112b71614ff3dc708e9d1473b
SHA51209ab56440867a523483cefb4d0d6b66fb395ebc4a3e4127384e132c54e73e8266f95ac59fdde3d4dac6a02895a08a38dd5b47c3c988db16d9536e021b139dbee
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
49KB
MD502ecc74f7f91e9ffd84de708683236a6
SHA13532de0b77df8b0fc89e9c7eddec3fa71f98f5a2
SHA25630ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e
SHA512a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541