Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 10:13
Behavioral task
behavioral1
Sample
2f4672168da491d4e01388c131334827_JaffaCakes118.exe
Resource
win7-20240903-en
5 signatures
150 seconds
General
-
Target
2f4672168da491d4e01388c131334827_JaffaCakes118.exe
-
Size
31KB
-
MD5
2f4672168da491d4e01388c131334827
-
SHA1
a757020b9b057033616d469e0a0473cec5489e72
-
SHA256
d99ec7fb27a7d33a329db0ceb1259467161de16640f6cbbed93f7df5497a3eb5
-
SHA512
901cbec56f626d9b9e3bcb069a7ed3b25665623ec293fe4de20506c341209115c5f3fd1eda3a7a6b22ad3e8d63da91a45b5c08989bda2695272227e711dee362
-
SSDEEP
768:UMopdCd8WGhT0IjX74hpun67sTykUTOMW:1qeIjchU6wukUTOj
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2f4672168da491d4e01388c131334827_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\E:\AutoRun.Inf 2f4672168da491d4e01388c131334827_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2840-0-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/2840-2-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\PLUGINS\System64.Jmp 2f4672168da491d4e01388c131334827_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\PLUGINS\System64.Jmp 2f4672168da491d4e01388c131334827_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\PLUGINS\System64.Sys 2f4672168da491d4e01388c131334827_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F} 2f4672168da491d4e01388c131334827_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\ 2f4672168da491d4e01388c131334827_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\InProcServer32 2f4672168da491d4e01388c131334827_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\InProcServer32\ = "C:\\Program Files\\Internet Explorer\\PLUGINS\\System64.Sys" 2f4672168da491d4e01388c131334827_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}\InProcServer32\ThreadingModel = "Apartment" 2f4672168da491d4e01388c131334827_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f4672168da491d4e01388c131334827_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f4672168da491d4e01388c131334827_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies registry class
PID:2840