Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe
-
Size
187KB
-
MD5
f5a56b83bc5e9ee0dd18d4685b9e1669
-
SHA1
3fe96db022d54472f92cc046981dbc2cd9cba49b
-
SHA256
4b69f88b0aa9157bab884cd8af64c315998d94ac6bcf875c4737e6fe35ba9be7
-
SHA512
4af93bef311980320689b831c5b423fe6be6f88503e29fca05764fb213b4156ee4215743bc487ea624811a3363015f526f2213fe2584a9cbe36b8753a60d1a35
-
SSDEEP
3072:Bd+QJz+sQsGs3gU6J/CW+1V2WGmRtC0VnZ3Nl8xHmAWL:Bd7aU6Jqf1VxG2C0VZ3Ncf8
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2740 CZY.EXE 2988 CZY2008.EXE 2708 CZY.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2740 set thread context of 2708 2740 CZY.EXE 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZY.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZY.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZY2008.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2740 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 30 PID 1884 wrote to memory of 2740 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 30 PID 1884 wrote to memory of 2740 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 30 PID 1884 wrote to memory of 2740 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 30 PID 1884 wrote to memory of 2988 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 31 PID 1884 wrote to memory of 2988 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 31 PID 1884 wrote to memory of 2988 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 31 PID 1884 wrote to memory of 2988 1884 f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe 31 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32 PID 2740 wrote to memory of 2708 2740 CZY.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\CZY.EXE"C:\CZY.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\CZY.EXE"C:\CZY.EXE"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
C:\CZY2008.EXE"C:\CZY2008.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD50ced035763b99aa9a7db861d6054ed77
SHA1f924c36203918d6f79698793431eb5ed5359d0b0
SHA256ac390f581121cb3dac6660db000b7a28a954e7a54c215ffafbdad3372cd0e658
SHA512f0fbc97ccc802b0d7e88255a88ae964f77d2bb6b9c3f151daf6f3cd7bcc0f0babf48d38c59e8ccb616b381c4257ee1ab817445aafe7cb18e90490515be95c864
-
Filesize
34KB
MD5a0507239adad53ba7d98b365eb27bd52
SHA17ccf3686de07b2332a81d303361525ec294851fb
SHA2566b873f0ddaecfd02dfd44dd235e9261ae7de845160118aa41cbe1bf659a8291e
SHA51244707623384be0d167e9abb717505a9e84603e568b85307d792d7f147e1189ef10ccd3711ca91e1b6dcbbb602d25696603b1e84faa62103949c62fc59cb8c304