Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 17:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
beeigjebea.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
beeigjebea.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe
-
Size
339KB
-
MD5
f67a187f0ebe3a32b5d6fa9689d8e8de
-
SHA1
58e7bff8a461401014d69ac74c5d1b7081514355
-
SHA256
200db4a541b1e405c7b3e80d71124be92d155125c69de148dbd14aa8d4f656fd
-
SHA512
4fd0a3695eebedbdb397d31b7841e503b85429195cf23abfaf46ee5ff5fff3789051991894c3c82fef5eaf9127f8ca83bca7d886ecfe62fb4e1794c87a363fd8
-
SSDEEP
6144:VFJ0Z0rHu5BQ77sHIWvTbF8cCzLqpdCSXZqSP14:kiHu5BQv8TbF8cCPqp18sm
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2352 beeigjebea.exe -
Loads dropped DLL 5 IoCs
pid Process 2916 f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe 2748 WerFault.exe 2748 WerFault.exe 2748 WerFault.exe 2748 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2748 2352 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beeigjebea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2004 wmic.exe Token: SeSecurityPrivilege 2004 wmic.exe Token: SeTakeOwnershipPrivilege 2004 wmic.exe Token: SeLoadDriverPrivilege 2004 wmic.exe Token: SeSystemProfilePrivilege 2004 wmic.exe Token: SeSystemtimePrivilege 2004 wmic.exe Token: SeProfSingleProcessPrivilege 2004 wmic.exe Token: SeIncBasePriorityPrivilege 2004 wmic.exe Token: SeCreatePagefilePrivilege 2004 wmic.exe Token: SeBackupPrivilege 2004 wmic.exe Token: SeRestorePrivilege 2004 wmic.exe Token: SeShutdownPrivilege 2004 wmic.exe Token: SeDebugPrivilege 2004 wmic.exe Token: SeSystemEnvironmentPrivilege 2004 wmic.exe Token: SeRemoteShutdownPrivilege 2004 wmic.exe Token: SeUndockPrivilege 2004 wmic.exe Token: SeManageVolumePrivilege 2004 wmic.exe Token: 33 2004 wmic.exe Token: 34 2004 wmic.exe Token: 35 2004 wmic.exe Token: SeIncreaseQuotaPrivilege 2004 wmic.exe Token: SeSecurityPrivilege 2004 wmic.exe Token: SeTakeOwnershipPrivilege 2004 wmic.exe Token: SeLoadDriverPrivilege 2004 wmic.exe Token: SeSystemProfilePrivilege 2004 wmic.exe Token: SeSystemtimePrivilege 2004 wmic.exe Token: SeProfSingleProcessPrivilege 2004 wmic.exe Token: SeIncBasePriorityPrivilege 2004 wmic.exe Token: SeCreatePagefilePrivilege 2004 wmic.exe Token: SeBackupPrivilege 2004 wmic.exe Token: SeRestorePrivilege 2004 wmic.exe Token: SeShutdownPrivilege 2004 wmic.exe Token: SeDebugPrivilege 2004 wmic.exe Token: SeSystemEnvironmentPrivilege 2004 wmic.exe Token: SeRemoteShutdownPrivilege 2004 wmic.exe Token: SeUndockPrivilege 2004 wmic.exe Token: SeManageVolumePrivilege 2004 wmic.exe Token: 33 2004 wmic.exe Token: 34 2004 wmic.exe Token: 35 2004 wmic.exe Token: SeIncreaseQuotaPrivilege 768 wmic.exe Token: SeSecurityPrivilege 768 wmic.exe Token: SeTakeOwnershipPrivilege 768 wmic.exe Token: SeLoadDriverPrivilege 768 wmic.exe Token: SeSystemProfilePrivilege 768 wmic.exe Token: SeSystemtimePrivilege 768 wmic.exe Token: SeProfSingleProcessPrivilege 768 wmic.exe Token: SeIncBasePriorityPrivilege 768 wmic.exe Token: SeCreatePagefilePrivilege 768 wmic.exe Token: SeBackupPrivilege 768 wmic.exe Token: SeRestorePrivilege 768 wmic.exe Token: SeShutdownPrivilege 768 wmic.exe Token: SeDebugPrivilege 768 wmic.exe Token: SeSystemEnvironmentPrivilege 768 wmic.exe Token: SeRemoteShutdownPrivilege 768 wmic.exe Token: SeUndockPrivilege 768 wmic.exe Token: SeManageVolumePrivilege 768 wmic.exe Token: 33 768 wmic.exe Token: 34 768 wmic.exe Token: 35 768 wmic.exe Token: SeIncreaseQuotaPrivilege 1868 wmic.exe Token: SeSecurityPrivilege 1868 wmic.exe Token: SeTakeOwnershipPrivilege 1868 wmic.exe Token: SeLoadDriverPrivilege 1868 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2352 2916 f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2352 2916 f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2352 2916 f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe 30 PID 2916 wrote to memory of 2352 2916 f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe 30 PID 2352 wrote to memory of 2004 2352 beeigjebea.exe 31 PID 2352 wrote to memory of 2004 2352 beeigjebea.exe 31 PID 2352 wrote to memory of 2004 2352 beeigjebea.exe 31 PID 2352 wrote to memory of 2004 2352 beeigjebea.exe 31 PID 2352 wrote to memory of 768 2352 beeigjebea.exe 34 PID 2352 wrote to memory of 768 2352 beeigjebea.exe 34 PID 2352 wrote to memory of 768 2352 beeigjebea.exe 34 PID 2352 wrote to memory of 768 2352 beeigjebea.exe 34 PID 2352 wrote to memory of 1868 2352 beeigjebea.exe 36 PID 2352 wrote to memory of 1868 2352 beeigjebea.exe 36 PID 2352 wrote to memory of 1868 2352 beeigjebea.exe 36 PID 2352 wrote to memory of 1868 2352 beeigjebea.exe 36 PID 2352 wrote to memory of 2784 2352 beeigjebea.exe 38 PID 2352 wrote to memory of 2784 2352 beeigjebea.exe 38 PID 2352 wrote to memory of 2784 2352 beeigjebea.exe 38 PID 2352 wrote to memory of 2784 2352 beeigjebea.exe 38 PID 2352 wrote to memory of 2744 2352 beeigjebea.exe 40 PID 2352 wrote to memory of 2744 2352 beeigjebea.exe 40 PID 2352 wrote to memory of 2744 2352 beeigjebea.exe 40 PID 2352 wrote to memory of 2744 2352 beeigjebea.exe 40 PID 2352 wrote to memory of 2748 2352 beeigjebea.exe 42 PID 2352 wrote to memory of 2748 2352 beeigjebea.exe 42 PID 2352 wrote to memory of 2748 2352 beeigjebea.exe 42 PID 2352 wrote to memory of 2748 2352 beeigjebea.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f67a187f0ebe3a32b5d6fa9689d8e8de_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\beeigjebea.exeC:\Users\Admin\AppData\Local\Temp\beeigjebea.exe 2/7/1/5/4/0/2/3/1/8/2 LUlIPzkyMTAxLx4tTFQ9TElCOi8YLUw+U1JLUklGQzUvHihDRE9UR0E8Kjc1Ly8bK0NHQTwoHi1JUUpAVUFRXkFCOys4KywwHixSPVBUPlFaUVJKOmdscm4zLipvcnQrQz1RSSZTSkwtP01PJkdMP04bK0NKRkJDR0I2NnVeUkNsMEhxUTo3MmdQdk5zKDNdS2VnVkZgSiwvbk5Lc0NFS2V2S10ubW1RX2tpTGpHYWQvTC8/MXdBX1hPQklTU20/LXdhbCVjbFI4akkxVHNLSD8xUGFOXjZla0VpSC5PeGZWWHU+ZDlwSUlPPEo5R2cfJ0IvNiwsHC9CLzwlLx4oQy45LS8dLjwyOyYwGytEMzosKR4tSVFKQFVBUV5IUEdPQD5VPR4sT0pNQk5CT1tFU0lANR4tSVFKQFVBUV5GP0s+PGZfaGNwciVjamJzYBwvQ1VEV1NQRTwfd1VQSXwYLUNRRFo/TUJJSEZDOxkuQ0tTUlxBSk1VTERNOTUeLFNAP0xEWEpRX1NPSzVmcm1vNSsvX2BrYWFpJ2BfZG9hLi1mY3Ioc3BLdzZJNTtJd3NuUExXUTNnZ2w3Zj5vcD0wI3VZcC82JXFdcjA6JW5fcCw8LTIxMyNPO1JWNiVoOWthZWRrcStea2RwZR4sVUU7MBkuP08xOy81KTMeKFFQSlRHSkRXVUNFQkpJRUdKQD9DU0tLOBwvR1BeSlNMTUhIQT1yb3RdHi1LRE9RUkxGTT9dU0xETVtEP1ZSNTAeKEdEQEVWOjAYLUdMXj9VTj9KSDtdQ0dCTVVQUkJDNWRfZXJgHC9CTFZGSk06Q1pFUDsvLzAsLyovKTUzLC4xKh4tSUBNPUxKQktXR0xMUzxITDtxcW1jHihTRElFOy4zLDY1KTUrMjAeLENHVUxFTjxAX1JGTD07LyouLTQvMC0wLSgvKTktLTouLSk5Sw==2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727284368.txt bios get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727284368.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727284368.txt bios get version3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727284368.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81727284368.txt bios get version3⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
538KB
MD554748049ae5bffdf965cc184ab998651
SHA1cd239c8003d4156dac4203bcbebf67117a485051
SHA2567777742990e8dedd4f6396264c61dc6abd50040994add85e6d0131b0e5e2bb87
SHA5126bfcdbac8248fa432e679ea9093939ddc6387dd3f2015ea5eb6a877f3ccdb39b59bbfe2379d54e451caf405543522371db0a6450f2c1079e3298a72b0c961209