Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe
-
Size
207KB
-
MD5
fcfed246fb7189abf69be6e01fdc48c3
-
SHA1
6174a7e9c6b29ce10fa4df221898f357ec4cd60c
-
SHA256
44d115e6bc671cdd9776f8cce9c15db434bf9d68d7b3b678aaa2d8cf476547ee
-
SHA512
59844214abc5ae501d3d7148942eb033aba8b63dce19fcff82a4e22de97249bb319e7bb2f45350b61711363a1707a62bad3c08e9a403512f6d53c79cc837ae5c
-
SSDEEP
3072:h9EHoyEfcefBjvLUrUQxo6aeYON/LDXzPvYfcrRsCdEPF6a4U2EOUx6Z9oXYHqOM:wHCtwjSedtcfcrRw6a4eOUYb
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 588 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 332 csrss.exe -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2252 set thread context of 588 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 332 csrss.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe Token: SeDebugPrivilege 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1200 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 21 PID 2252 wrote to memory of 332 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 2 PID 332 wrote to memory of 2468 332 csrss.exe 30 PID 332 wrote to memory of 2468 332 csrss.exe 30 PID 2252 wrote to memory of 588 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 31 PID 2252 wrote to memory of 588 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 31 PID 2252 wrote to memory of 588 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 31 PID 2252 wrote to memory of 588 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 31 PID 2252 wrote to memory of 588 2252 fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe 31 PID 332 wrote to memory of 876 332 csrss.exe 13
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of AdjustPrivilegeToken
PID:876 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:2468
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcfed246fb7189abf69be6e01fdc48c3_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
2KB
MD55aa5fd64913e65c918d730ab81614e2e
SHA1cab1803ab60f5274b074c3cdaaabb2b9492470ff
SHA256e51d7589bfa5b3ec3218f97ed0a79e3ec341b210c3a1c85761e6553c127db936
SHA5122e726825e21a068471c59fe4e83fed80b52670fbdbe75c263187b4fa3d8a97d733c6a67debff8b10d853160aa3933cb07356e82d5f647a8b43f52d835a08d06e