Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe
-
Size
200KB
-
MD5
2abc54b6e60ce6150710266937592b6c
-
SHA1
c65d5fb77f4cad3ed30203bbf869f1d912bb203e
-
SHA256
0a28563e46f6a996870b3a452fc15959ca156ed11d39c8a5599dea17c005cdc2
-
SHA512
8de741ed6a95aa4c0cfffa762b40f73ab1856b394d5ff75957def51b5ff7a0e4a396c9d7b347cd1150fa10c8df6109caac71dbec1e1104cd943b03e8cebfd359
-
SSDEEP
6144:nFn9D7/p5/JpbqLGKTxRAYtUUMkRSJ91dL:x9D7/p5/JsisxRAJjaSb1h
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2760 svchost.exe 2108 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 2236 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 2236 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 2760 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe" 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2648 set thread context of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2760 set thread context of 2108 2760 svchost.exe 32 -
resource yara_rule behavioral1/memory/2236-2-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2236-5-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2236-4-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2236-17-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2108-26-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2108-27-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2108-28-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2108-30-0x0000000000400000-0x0000000000416000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 2760 svchost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2236 2648 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 30 PID 2236 wrote to memory of 2760 2236 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 31 PID 2236 wrote to memory of 2760 2236 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 31 PID 2236 wrote to memory of 2760 2236 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 31 PID 2236 wrote to memory of 2760 2236 2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe 31 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32 PID 2760 wrote to memory of 2108 2760 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2abc54b6e60ce6150710266937592b6c_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2108
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD52abc54b6e60ce6150710266937592b6c
SHA1c65d5fb77f4cad3ed30203bbf869f1d912bb203e
SHA2560a28563e46f6a996870b3a452fc15959ca156ed11d39c8a5599dea17c005cdc2
SHA5128de741ed6a95aa4c0cfffa762b40f73ab1856b394d5ff75957def51b5ff7a0e4a396c9d7b347cd1150fa10c8df6109caac71dbec1e1104cd943b03e8cebfd359