Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe
-
Size
14KB
-
MD5
f56f3cd3731a417db88d068eb8448bd1
-
SHA1
8675d59d0b13e8ba1828e56b58a64f2b16fd1821
-
SHA256
c51b23f5bbb9928f62b2de7941185168bc3a2a0da722964b29ec81f082542e0b
-
SHA512
8030579ac46598be03119d633441f075903df919f201474ea2d5f346384b381fa47f3796151484f6dc37436be880a202efbc8a43cf327c8b6d744b85d270cc75
-
SSDEEP
384:+U7pctbeRIepz3NakcVRkZDvHVjL0Hm3vcqQK:dpctSqi38VRkZDvHVjLJcq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2920 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\videoPl.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}" f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1244 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 30 PID 1908 wrote to memory of 1244 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 30 PID 1908 wrote to memory of 1244 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 30 PID 1908 wrote to memory of 1244 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 30 PID 1908 wrote to memory of 2920 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 33 PID 1908 wrote to memory of 2920 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 33 PID 1908 wrote to memory of 2920 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 33 PID 1908 wrote to memory of 2920 1908 f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f56f3cd3731a417db88d068eb8448bd1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe2⤵
- System Location Discovery: System Language Discovery
PID:1244
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\awer0.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302B
MD587994351df53db744bfa1e4378161895
SHA1e9bc5e1b6a3743b58689390d4632186e63d08c58
SHA256e5c6f90f6620030ac39a494b8fff58c88b29aabbb4aee7dfe845fac8fd06ca83
SHA512d0ed026bcee6a99cca92e55769bd70ac2a85ceae0ca0aa6c7cdc2675f6fdc1b838ba2593127509b2f8aa6684c3fd7c2f75c6797976ec8a5c0f165cc61e7d1b54