Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/installer.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/installer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
General
-
Target
14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe
-
Size
280KB
-
MD5
14a1837a69256daa3089f241a54767bb
-
SHA1
9250b6882f1105c159c17ae221249f7ef6c721e3
-
SHA256
604943ffeae818c064d8da3e9d9a651f2b04d15137a4fdfeffc2486dc1752e25
-
SHA512
8a2053a48fb0c79fd990bbae5917658a5e3e5b06ca9bcbe2c2280a03450ed68877e973959d596fc44f5a3d8ebb0aeb08e3023da990390c63d9e815ca7a4a5ca7
-
SSDEEP
6144:psaocyLC0HU6MED7c29CxANmAmevetoduog0PV1fHbf:ptobbdMi42AxwmAu5og0bb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2188 installer.exe 2472 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Loads dropped DLL 3 IoCs
pid Process 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2472 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2472 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2472 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe 2472 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2188 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2188 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2188 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2188 1636 14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2472 2188 installer.exe 30 PID 2188 wrote to memory of 2472 2188 installer.exe 30 PID 2188 wrote to memory of 2472 2188 installer.exe 30 PID 2188 wrote to memory of 2472 2188 installer.exe 30 PID 2188 wrote to memory of 2472 2188 installer.exe 30 PID 2188 wrote to memory of 2472 2188 installer.exe 30 PID 2188 wrote to memory of 2472 2188 installer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14a1837a69256daa3089f241a54767bb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\nstA575.tmp\installer.exeC:\Users\Admin\AppData\Local\Temp\nstA575.tmp\installer.exe 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe /t /dT132281210S /e5843895 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\nstA575.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe/t /dT132281210S /e5843895 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5e5fdaf113b510ceaf5672d7af36eaa75
SHA1ee4c3b6d2343650926944869a07e31a9a2a4ffc5
SHA256d4f2a25d2831f368313160bf2e2983264426ba9e4027447440b5a3ee8bb8b526
SHA512f55acf149353251d44d768381a9256f509c62e24479775a24924c584a29fd7cdc2f705b84318a0280ca9731c6c3b4be993045e2e925cd42ef7a9e64e21e584a8
-
Filesize
207KB
MD5de8e9cb3a534359f5809b9c5980ce365
SHA134def3bd6d46a97daa546671513733b9a94c1e8a
SHA256653db07daeedb23437e723f00ab4f7320e5bb6e6689e38e54896ee44d84cfc71
SHA512dffe030837a4babfb06419ffd893f54b9856e0f1aafb320e923a7a4aea894154207b0f2998fd0ecaaf0105c6ff1bed95d93a8ae2f531e1c8c3aca248a35b1fe2
-
Filesize
8KB
MD5249ae678f0dac4c625c6de6aca53823a
SHA16ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA2567298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
SHA51266e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7