Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 12:27
Behavioral task
behavioral1
Sample
3fda62d225b996689370e49ace584024_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3fda62d225b996689370e49ace584024_JaffaCakes118.exe
-
Size
228KB
-
MD5
3fda62d225b996689370e49ace584024
-
SHA1
5ac51aaa9af6c28153c2c84b20580cfe576a2345
-
SHA256
19075bef02751617b806bed66352f791ab93cf456e4e4debd66f9d0adfadeab9
-
SHA512
b75090ea01d31df3c10e98bcc03ecf4a4ebfce4853d0592759cee8d0b51c212225d657461e4ca14dc93154daedb7f38ffc7e1ea5aad024354b6ffff55e6af390
-
SSDEEP
6144:zAmIhgpYy4c2+keFKEK7kmR/qszYX1932QVTH3jRVI6a:zVIhgpYR+keoAmRCsm9Zs
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2528 ins8093.exe 2748 ins.exe -
Loads dropped DLL 5 IoCs
pid Process 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/3044-1-0x0000000000FA0000-0x0000000000FFE000-memory.dmp upx behavioral1/memory/3044-30-0x0000000000FA0000-0x0000000000FFE000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fda62d225b996689370e49ace584024_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ins.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2748 ins.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2748 ins.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 ins.exe 2748 ins.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2528 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2528 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2528 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2528 3044 3fda62d225b996689370e49ace584024_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2748 2528 ins8093.exe 31 PID 2528 wrote to memory of 2748 2528 ins8093.exe 31 PID 2528 wrote to memory of 2748 2528 ins8093.exe 31 PID 2528 wrote to memory of 2748 2528 ins8093.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fda62d225b996689370e49ace584024_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3fda62d225b996689370e49ace584024_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe"C:\Users\Admin\AppData\Local\Temp\ins8093\ins8093.exe" ins.exe /e10742466 /u52173bb8-0ed4-4c29-9d48-482f0a0000132⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe"C:\Users\Admin\AppData\Local\Temp\ins8093\ins.exe" /e10742466 /u52173bb8-0ed4-4c29-9d48-482f0a0000133⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD5990774201cab9f23e9b2a4dbfd7b322d
SHA1a77b83a8a3b9efcc38e8b3d1c42e681c1450470c
SHA25668da632d702639815cc5875aefd103304c528df93bd8e197e7d6335787d131ae
SHA5121d15af0b2a44b23319ffe35164b285868a32cd7b2e5810bf97902d5f91891eaf6f8f6e182d0ca9e6090a670f768567a3f667a95451d93e9881734f0c8b2ebde5
-
Filesize
137KB
MD5658f4a04835c8522c64b73d478cb023d
SHA1c1ed730661467a430e41247d5518afeb25ca7f7d
SHA256d8e92455694e8d5cd8266221e5a536014b57df4169cb6793a5dabb0b42f0d781
SHA512c36ad5a49416f1dc0fa67068a106d120449ec3bb6e39a05e3730ca4cc982d6a7b01bbe7993ec74f3351223529ef3eb0a0df1f27180012ac21fadf5e2d953e1eb