Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 15:07
Behavioral task
behavioral1
Sample
f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe
-
Size
160KB
-
MD5
f00ea16417ee80ae8bf132df525459e9
-
SHA1
4cc0417aaa3c931345d83141e1e8fdc03b9c4223
-
SHA256
fc2bc41501d6f8d37111626863cec9e9b345ce8e8250bd2466f62a1b3b873773
-
SHA512
25c406b2a850e8c94079fe6feab90cab4d47c5ed6dd7b20b69c8d71b75a40d19323938e2be7befed84c311d753163f62a293d20a4e83d4ffd9cc8f17d1f7f72e
-
SSDEEP
3072:JYAq+Bt0h0phE8M4qTvpmwEBn3Obl4kUGE84NXaf0:JYtipO4qTvwwm0KD/e0
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
resource yara_rule behavioral1/files/0x00090000000120fb-6.dat aspack_v212_v242 -
Executes dropped EXE 10 IoCs
pid Process 1740 tsqla.exe 2248 tsqla.exe 2840 tsqla.exe 2700 tsqla.exe 1800 tsqla.exe 1540 tsqla.exe 1924 tsqla.exe 2920 tsqla.exe 1472 tsqla.exe 580 tsqla.exe -
Loads dropped DLL 20 IoCs
pid Process 2356 f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe 2356 f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe 1740 tsqla.exe 1740 tsqla.exe 2248 tsqla.exe 2248 tsqla.exe 2840 tsqla.exe 2840 tsqla.exe 2700 tsqla.exe 2700 tsqla.exe 1800 tsqla.exe 1800 tsqla.exe 1540 tsqla.exe 1540 tsqla.exe 1924 tsqla.exe 1924 tsqla.exe 2920 tsqla.exe 2920 tsqla.exe 1472 tsqla.exe 1472 tsqla.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File created C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe File opened for modification C:\Windows\SysWOW64\tsqla.exe tsqla.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqla.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1740 2356 f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe 30 PID 2356 wrote to memory of 1740 2356 f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe 30 PID 2356 wrote to memory of 1740 2356 f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe 30 PID 2356 wrote to memory of 1740 2356 f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe 30 PID 1740 wrote to memory of 2248 1740 tsqla.exe 32 PID 1740 wrote to memory of 2248 1740 tsqla.exe 32 PID 1740 wrote to memory of 2248 1740 tsqla.exe 32 PID 1740 wrote to memory of 2248 1740 tsqla.exe 32 PID 2248 wrote to memory of 2840 2248 tsqla.exe 33 PID 2248 wrote to memory of 2840 2248 tsqla.exe 33 PID 2248 wrote to memory of 2840 2248 tsqla.exe 33 PID 2248 wrote to memory of 2840 2248 tsqla.exe 33 PID 2840 wrote to memory of 2700 2840 tsqla.exe 34 PID 2840 wrote to memory of 2700 2840 tsqla.exe 34 PID 2840 wrote to memory of 2700 2840 tsqla.exe 34 PID 2840 wrote to memory of 2700 2840 tsqla.exe 34 PID 2700 wrote to memory of 1800 2700 tsqla.exe 35 PID 2700 wrote to memory of 1800 2700 tsqla.exe 35 PID 2700 wrote to memory of 1800 2700 tsqla.exe 35 PID 2700 wrote to memory of 1800 2700 tsqla.exe 35 PID 1800 wrote to memory of 1540 1800 tsqla.exe 36 PID 1800 wrote to memory of 1540 1800 tsqla.exe 36 PID 1800 wrote to memory of 1540 1800 tsqla.exe 36 PID 1800 wrote to memory of 1540 1800 tsqla.exe 36 PID 1540 wrote to memory of 1924 1540 tsqla.exe 37 PID 1540 wrote to memory of 1924 1540 tsqla.exe 37 PID 1540 wrote to memory of 1924 1540 tsqla.exe 37 PID 1540 wrote to memory of 1924 1540 tsqla.exe 37 PID 1924 wrote to memory of 2920 1924 tsqla.exe 38 PID 1924 wrote to memory of 2920 1924 tsqla.exe 38 PID 1924 wrote to memory of 2920 1924 tsqla.exe 38 PID 1924 wrote to memory of 2920 1924 tsqla.exe 38 PID 2920 wrote to memory of 1472 2920 tsqla.exe 39 PID 2920 wrote to memory of 1472 2920 tsqla.exe 39 PID 2920 wrote to memory of 1472 2920 tsqla.exe 39 PID 2920 wrote to memory of 1472 2920 tsqla.exe 39 PID 1472 wrote to memory of 580 1472 tsqla.exe 40 PID 1472 wrote to memory of 580 1472 tsqla.exe 40 PID 1472 wrote to memory of 580 1472 tsqla.exe 40 PID 1472 wrote to memory of 580 1472 tsqla.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 476 "C:\Users\Admin\AppData\Local\Temp\f00ea16417ee80ae8bf132df525459e9_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 536 "C:\Windows\SysWOW64\tsqla.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 544 "C:\Windows\SysWOW64\tsqla.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 532 "C:\Windows\SysWOW64\tsqla.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 548 "C:\Windows\SysWOW64\tsqla.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 528 "C:\Windows\SysWOW64\tsqla.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 540 "C:\Windows\SysWOW64\tsqla.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 552 "C:\Windows\SysWOW64\tsqla.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 564 "C:\Windows\SysWOW64\tsqla.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\tsqla.exeC:\Windows\system32\tsqla.exe 560 "C:\Windows\SysWOW64\tsqla.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:580
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5f00ea16417ee80ae8bf132df525459e9
SHA14cc0417aaa3c931345d83141e1e8fdc03b9c4223
SHA256fc2bc41501d6f8d37111626863cec9e9b345ce8e8250bd2466f62a1b3b873773
SHA51225c406b2a850e8c94079fe6feab90cab4d47c5ed6dd7b20b69c8d71b75a40d19323938e2be7befed84c311d753163f62a293d20a4e83d4ffd9cc8f17d1f7f72e