Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 16:48
Behavioral task
behavioral1
Sample
fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe
-
Size
28KB
-
MD5
fcba78f8acc53be670e24016fd3028d9
-
SHA1
52992542c5bb196baad517fa9c878afed6691263
-
SHA256
3e860005f987025e2a77fc7d5bbcf21df32a519fd513ba2e94099aacc6cfc21a
-
SHA512
7fa5590f57ab42337224ccbb7a1f47a806c03005f7fd4ee25c00180cdcecb802fb68fa3fd9c6b24a66badf0b3f4a6268fe0292ce870c8b0f58766e661dee8572
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNYAV:Dv8IRRdsxq1DjJcqfq
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
resource yara_rule behavioral1/memory/1880-17-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1880-55-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1880-60-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1880-84-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1880-86-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1880-91-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom -
Executes dropped EXE 1 IoCs
pid Process 2404 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
resource yara_rule behavioral1/memory/1880-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1880-4-0x0000000000220000-0x0000000000228000-memory.dmp upx behavioral1/files/0x00060000000193b5-7.dat upx behavioral1/memory/2404-11-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1880-9-0x0000000000220000-0x0000000000228000-memory.dmp upx behavioral1/memory/1880-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2404-19-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-20-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-25-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-30-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-32-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-37-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-42-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-44-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-49-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2404-54-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1880-55-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2404-56-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1880-60-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2404-61-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/files/0x000900000001933b-71.dat upx behavioral1/memory/1880-84-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2404-85-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1880-86-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2404-87-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1880-91-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2404-92-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe File opened for modification C:\Windows\java.exe fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe File created C:\Windows\java.exe fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2404 1880 fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe 31 PID 1880 wrote to memory of 2404 1880 fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe 31 PID 1880 wrote to memory of 2404 1880 fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe 31 PID 1880 wrote to memory of 2404 1880 fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcba78f8acc53be670e24016fd3028d9_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5aa3016eb762f6a2ff9196d68a248460a
SHA171b7c3d6ac256d6d72a306f402e9d8fd5611d854
SHA25643cbec87a2f9e3ecc8f405c1fcd2eb2747b463aeb25456d6195056f99f0548ce
SHA51230892583fb08335221a268a97b67e2d8442cafd1ba43c609a55366386270c61999730cd47551982a413317cd3371e87e98c31967e2253340d29f4e7a28e1d550
-
Filesize
1KB
MD59ce03a27d9ba2bdba1015ee92ba2b04e
SHA140c327f02b1679aa9f4550438fb7859b6d80f4f5
SHA256ab48720ca1ba07994d8d1d42e26600195dd9846a494bed8d75c23e82ec1cbbb1
SHA512874a81211478b16ebce04f33c45cff6260fcf2d98d6391345f752a0bc53b8701cf1a52b6042539f159d58039698f8a05c288b1c36e8beae67964df3af35849ce
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2