Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 10:25
Behavioral task
behavioral1
Sample
fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe
-
Size
98KB
-
MD5
fc1866f8b1d45ef6079c7ca78409cd5c
-
SHA1
52e0bc136e9b8f66b1694ab23f26d00f2ce0f9de
-
SHA256
5c8dd7078de9ef405ad4b60018079b2716e8e14306276792ceb85ade3c56a2ad
-
SHA512
d0b3833dadb095f63467d0d65fa06c96b9b71353e305b1ef5d6ec17407684c24b0950c253408975f1073702e60572580def8e2bdf94b63f9473057995cb22f69
-
SSDEEP
1536:F0iGPTzmITdUcCeU2Sq9JmDXVzBUSeG+T5nouy8xFvJ3/FK1SIz:hGryITtUmbmziboutvG
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2912 cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\G: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\N: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\S: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\V: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\Y: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\B: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\T: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\W: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\M: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\I: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\L: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\O: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\R: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\X: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\Z: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\A: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\J: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\K: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\P: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\Q: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\U: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe File opened (read-only) \??\H: fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2932-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2932-10-0x0000000000400000-0x0000000000523000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2912 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2912 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2912 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2912 2932 fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninstf7788cf.bat" "C:\Users\Admin\AppData\Local\Temp\fc1866f8b1d45ef6079c7ca78409cd5c_JaffaCakes118.exe""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59B
MD52988b921fbed03f9c93c5d538932bbe3
SHA14b791b3d59ae76ff091c2cf201b40f5d1b432a3f
SHA256a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3
SHA5122920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9