Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe
-
Size
72KB
-
MD5
0898fe8bbe0ae64c3020a50c270d9830
-
SHA1
7aad8b97ea1b83edf505902567a0498aaa3b711c
-
SHA256
d36c72f7febf0f6efe034faf33c223f6e4c328662f85ae44222ae41b87f0e15d
-
SHA512
f8b99d78b517a3d6395a523111d15055cc935a6eef204c47cf888403bfec66a92e1a0ef3a15ff92de2a6ba1eb8372344961fca03c0d564d5eca335acf0311029
-
SSDEEP
768:9h+1iS7KkOCfJb4kHrgrTi6yBJJyNKJCviXDyiwSuo6zCNKVDr:/2DirEJycA8Dy9Suo6zCs
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2836 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 2356 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2356 AUDIODG.EXE Token: 33 2356 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2356 AUDIODG.EXE Token: SeDebugPrivilege 2836 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 904 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 904 wrote to memory of 2732 904 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe 30 PID 904 wrote to memory of 2732 904 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe 30 PID 904 wrote to memory of 2732 904 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe 30 PID 904 wrote to memory of 2732 904 0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2836 2732 cmd.exe 32 PID 2732 wrote to memory of 2836 2732 cmd.exe 32 PID 2732 wrote to memory of 2836 2732 cmd.exe 32 PID 2732 wrote to memory of 2836 2732 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0898fe8bbe0ae64c3020a50c270d9830_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 0898fe8bbe0ae64c3020a50c270d9830_J2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356