Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 20:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe
-
Size
308KB
-
MD5
ff3cc5b9d609c047b7eb0f717a372c48
-
SHA1
5f95da0e959faed4d23f2dda18230157751a0ad9
-
SHA256
1fe647c8bf4be7c18ba4e65025ed7928829177b180ac23afab686e1898713097
-
SHA512
31d81af2fdfc88a692d3d95c9c0af6286702130f0a653e3dbbdbd28244c902f476c4830305e9a90ad4e91f1d0cbaca005cf62280e4d50b6a0bb466dda6ec8b6b
-
SSDEEP
6144:FlB44GBkAqzqtZdv9kLj3rVfA8BBif3h0/y7p:FQnEKvybrVfA8Eh
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2696 load.exe 1044 load.exe 1440 load.exe 1984 load.exe 2372 load.exe 936 load.exe -
Loads dropped DLL 12 IoCs
pid Process 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2696 load.exe 2696 load.exe 1044 load.exe 1044 load.exe 1440 load.exe 1440 load.exe 1984 load.exe 1984 load.exe 2372 load.exe 2372 load.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\load.exe ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe File created C:\Windows\SysWOW64\load.exe load.exe File created C:\Windows\SysWOW64\load.exe load.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language load.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 2696 load.exe 1044 load.exe 1044 load.exe 1044 load.exe 1044 load.exe 1044 load.exe 1044 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1440 load.exe 1984 load.exe 1984 load.exe 1984 load.exe 1984 load.exe 1984 load.exe 1984 load.exe 2372 load.exe 2372 load.exe 2372 load.exe 2372 load.exe 2372 load.exe 2372 load.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2696 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 30 PID 2508 wrote to memory of 2696 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 30 PID 2508 wrote to memory of 2696 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 30 PID 2508 wrote to memory of 2696 2508 ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe 30 PID 2696 wrote to memory of 1044 2696 load.exe 31 PID 2696 wrote to memory of 1044 2696 load.exe 31 PID 2696 wrote to memory of 1044 2696 load.exe 31 PID 2696 wrote to memory of 1044 2696 load.exe 31 PID 1044 wrote to memory of 1440 1044 load.exe 32 PID 1044 wrote to memory of 1440 1044 load.exe 32 PID 1044 wrote to memory of 1440 1044 load.exe 32 PID 1044 wrote to memory of 1440 1044 load.exe 32 PID 1440 wrote to memory of 1984 1440 load.exe 33 PID 1440 wrote to memory of 1984 1440 load.exe 33 PID 1440 wrote to memory of 1984 1440 load.exe 33 PID 1440 wrote to memory of 1984 1440 load.exe 33 PID 1984 wrote to memory of 2372 1984 load.exe 34 PID 1984 wrote to memory of 2372 1984 load.exe 34 PID 1984 wrote to memory of 2372 1984 load.exe 34 PID 1984 wrote to memory of 2372 1984 load.exe 34 PID 2372 wrote to memory of 936 2372 load.exe 35 PID 2372 wrote to memory of 936 2372 load.exe 35 PID 2372 wrote to memory of 936 2372 load.exe 35 PID 2372 wrote to memory of 936 2372 load.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Users\Admin\AppData\Local\Temp\ff3cc5b9d609c047b7eb0f717a372c48_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\load.exeC:\Windows\system32\load.exe -bai C:\Windows\SysWOW64\load.exe7⤵
- Executes dropped EXE
PID:936
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD5ff3cc5b9d609c047b7eb0f717a372c48
SHA15f95da0e959faed4d23f2dda18230157751a0ad9
SHA2561fe647c8bf4be7c18ba4e65025ed7928829177b180ac23afab686e1898713097
SHA51231d81af2fdfc88a692d3d95c9c0af6286702130f0a653e3dbbdbd28244c902f476c4830305e9a90ad4e91f1d0cbaca005cf62280e4d50b6a0bb466dda6ec8b6b