Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe
-
Size
209KB
-
MD5
e238c4ec1716fe656488939e43fa2dae
-
SHA1
257b7e16c6d74b2ddf12e779ba24b5ef60fad226
-
SHA256
ba7f3164b131f926902a206834b5b4dd662153a8b9e9b1492fde60da853b2d51
-
SHA512
751cb2396c06de1ac0d20e8c751a098ca46d96cf592e1a1731e21a0fe3ac14e57aa2cd65fb6d03c15f0a55a7ecd3bb38ce1894e07ea7b15dd63d036227b5b05b
-
SSDEEP
3072:tVHgCc4xGvbwcU9KQ2BBAHmaPxBVoUb5Epj:QCc4xGxWKQ2BonxOj
Malware Config
Extracted
Protocol: ftp- Host:
ftp.byethost12.com - Port:
21 - Username:
b12_8082975 - Password:
951753zx
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2324 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2976 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe 2976 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\f1eb9525\jusched.exe e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe File created C:\Program Files (x86)\f1eb9525\f1eb9525 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2324 2976 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe 30 PID 2976 wrote to memory of 2324 2976 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe 30 PID 2976 wrote to memory of 2324 2976 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe 30 PID 2976 wrote to memory of 2324 2976 e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e238c4ec1716fe656488939e43fa2dae_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\f1eb9525\jusched.exe"C:\Program Files (x86)\f1eb9525\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD5134c1d489094d6d3399f65b0e9aebc1f
SHA1612a57fbe6ed3ab9c15b39451171d813314a28d5
SHA25654f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781
SHA512b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed
-
Filesize
209KB
MD5eff94fff54df4394f7961c9ca3c34d21
SHA16c8490aac90ad940d9124244181fe96d5c4ca9c5
SHA256f274fdd4fb2a1f062b665f205544b362531d199889042cc0d54053bddfb9dee6
SHA512628ced35ff7e80e1d050a1611728d522464055ca5b299226389bf7a2c93ae3addef41aa2bdca00348c0c424ce3db6d9bdbeeaeabb13c013d1dd3113e6fd5471b