Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 04:50
Behavioral task
behavioral1
Sample
ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe
-
Size
124KB
-
MD5
ef18c281208a5d536f4a5e765bd46aa3
-
SHA1
195939acadcbad6a51c074d9ba1a9ed329213640
-
SHA256
3ddb86ec00abc2f1af7787dac0c6451fc0de0283a69d3300d878344d38e4d48b
-
SHA512
291ff26dc3a1b651812b46c6428a8d021fa81ef2818920ea5b991019eec441a53fbc3f08a78da58833d86e6065e97df270b6fa1606c6799936cf0c30576c1c4d
-
SSDEEP
1536:LRRcgYZ6uBJFuNd7xoKQFcakHf1EUhP1AZ2IL1H2OUD4:NG3INRQFhk/1EUPA4IL1HtUD4
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2668-0-0x0000000000400000-0x0000000000420000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\:\WINDOWS\Temp\svchast.exe 202492145049.exe = "C:\\WINDOWS\\Temp\\svchast.exe 202492145049.exe" ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchast.exe 202492145049.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 2 IoCs
pid Process 2664 taskkill.exe 2928 taskkill.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2664 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2664 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2760 2668 ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe 31 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33 PID 2760 wrote to memory of 2928 2760 svchast.exe 202492145049.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ef18c281208a5d536f4a5e765bd46aa3_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\WINDOWS\Temp\svchast.exe 202492145049.exe"C:\WINDOWS\Temp\svchast.exe 202492145049.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-