Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/09/2024, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe
-
Size
304KB
-
MD5
e6f22ca7f7e05342709de3367352258c
-
SHA1
f7d911ff02edb4f7f7624ba9ab4a5143e5d30c38
-
SHA256
5744f89569706b092f3c84da42f2409318ce77b01b7173c722dd00d1c65f4864
-
SHA512
0c4b9ce2109e1acfc721ec2544548f24a1c083ebf3b207a3fadd1c4995805678381c51241afe9047b9e57403717353f425e7780d8b2d0df7b84731118966ad3b
-
SSDEEP
6144:qaTPKN8FoC+ZvWR6lCMDLz+1yMG1fef9jifVtg/Pb12m2wbtk7zRX9bvVPL:qaTPKN8F4jD+nG1fieNG/Pb12mtg9XTT
Malware Config
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2112-16-0x0000000000280000-0x00000000002AB000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe -
Loads dropped DLL 2 IoCs
pid Process 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe -
pid Process 2008 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1004 sc.exe 3020 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 2008 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2008 powershell.exe Token: SeTcbPrivilege 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2684 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2684 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2684 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2684 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2420 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2420 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2420 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2420 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2668 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 33 PID 2112 wrote to memory of 2668 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 33 PID 2112 wrote to memory of 2668 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 33 PID 2112 wrote to memory of 2668 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 33 PID 2112 wrote to memory of 2876 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 36 PID 2112 wrote to memory of 2876 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 36 PID 2112 wrote to memory of 2876 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 36 PID 2112 wrote to memory of 2876 2112 e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe 36 PID 2684 wrote to memory of 1004 2684 cmd.exe 38 PID 2684 wrote to memory of 1004 2684 cmd.exe 38 PID 2684 wrote to memory of 1004 2684 cmd.exe 38 PID 2684 wrote to memory of 1004 2684 cmd.exe 38 PID 2420 wrote to memory of 3020 2420 cmd.exe 37 PID 2420 wrote to memory of 3020 2420 cmd.exe 37 PID 2420 wrote to memory of 3020 2420 cmd.exe 37 PID 2420 wrote to memory of 3020 2420 cmd.exe 37 PID 2668 wrote to memory of 2008 2668 cmd.exe 39 PID 2668 wrote to memory of 2008 2668 cmd.exe 39 PID 2668 wrote to memory of 2008 2668 cmd.exe 39 PID 2668 wrote to memory of 2008 2668 cmd.exe 39 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 2876 wrote to memory of 2152 2876 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 40 PID 1372 wrote to memory of 2932 1372 taskeng.exe 42 PID 1372 wrote to memory of 2932 1372 taskeng.exe 42 PID 1372 wrote to memory of 2932 1372 taskeng.exe 42 PID 1372 wrote to memory of 2932 1372 taskeng.exe 42 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 PID 2932 wrote to memory of 1152 2932 e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6f22ca7f7e05342709de3367352258c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
-
C:\Users\Admin\AppData\Roaming\appnet\e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exeC:\Users\Admin\AppData\Roaming\appnet\e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2152
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1B6B1CB7-1DD8-455D-A39F-E499ECB7B60E} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Roaming\appnet\e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exeC:\Users\Admin\AppData\Roaming\appnet\e7f22ca8f8e06352809de3378362269c_KaffaDalet119.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1152
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
MD5e6f22ca7f7e05342709de3367352258c
SHA1f7d911ff02edb4f7f7624ba9ab4a5143e5d30c38
SHA2565744f89569706b092f3c84da42f2409318ce77b01b7173c722dd00d1c65f4864
SHA5120c4b9ce2109e1acfc721ec2544548f24a1c083ebf3b207a3fadd1c4995805678381c51241afe9047b9e57403717353f425e7780d8b2d0df7b84731118966ad3b