Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe
-
Size
144KB
-
MD5
08b8725e98146a5086d49ebe7ed9140f
-
SHA1
665019571627ce561a7b9c3c574855973008c8ea
-
SHA256
02ec887efb80984aab020b5ee269d5b3cf91c975ae25c3669cf9a8680e353092
-
SHA512
9e414f95c682b11d3a3a5bacfc400d831c0dc558876b24ac885412a031ef29e238f8f99af6b270119cc54edd28470a72831877c01e0c6bb09987a2ee57a4fa11
-
SSDEEP
3072:V7GeKlHBSvQ0tRpSFsOTHHrdT+cT3B0DBpq7qZ2o2LlmSbReH:VvsB6HMZHkDBZZ2bLlm
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2300 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2300 2416 08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2300 2416 08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2300 2416 08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2300 2416 08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08b8725e98146a5086d49ebe7ed9140f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bwp..bat" > nul 2> nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238B
MD55868e6f349b67f67a976b0944165b275
SHA1bcd3dd562e8bfb9c8476268e8140486392ac3916
SHA2567fa19358053419467d4302b5f9822b8421514ca54d369d2d47e2c74f24d377d6
SHA51259564d992552b5b3866894ebf9a8e51612035d855164452a75afa3f09748faf508d6a85969fd141d375ad1e359c9fb981cfb61db68474470e8205c7983210600