Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27/10/2024, 22:28
Static task
static1
Behavioral task
behavioral1
Sample
7642641936be02921252b837f10b27b0_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7642641936be02921252b837f10b27b0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
7642641936be02921252b837f10b27b0_JaffaCakes118.exe
-
Size
191KB
-
MD5
7642641936be02921252b837f10b27b0
-
SHA1
9899e974a2f033a577b49d82a1d4479af6f95e69
-
SHA256
732d0d953bf5afc402a06751ddf0ac1895712d721a41b38ff04e801d53ab006b
-
SHA512
fa503c74cf1321e3f0ccd8c366b250211bcfd6047519f637bde2e82d212061e4b7523ad761053e35b500bfb53cd5d2827b742a30fa46e0b5779571c69a46ae9e
-
SSDEEP
3072:1nqCC+6DPrf80KTw19bGBWQRdkPFcinV99ViNBT1q2cl1/Z9k6gHDzGSOv6HNWmK:Rqz+6DDf80/19aBWQ3API52l1/P0ZrlK
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe" 7642641936be02921252b837f10b27b0_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1820-2-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/2216-7-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/2216-5-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1820-14-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1660-74-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1820-75-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1820-168-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1820-207-0x0000000000400000-0x000000000048A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7642641936be02921252b837f10b27b0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7642641936be02921252b837f10b27b0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7642641936be02921252b837f10b27b0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2216 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 29 PID 1820 wrote to memory of 2216 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 29 PID 1820 wrote to memory of 2216 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 29 PID 1820 wrote to memory of 2216 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 29 PID 1820 wrote to memory of 1660 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 31 PID 1820 wrote to memory of 1660 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 31 PID 1820 wrote to memory of 1660 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 31 PID 1820 wrote to memory of 1660 1820 7642641936be02921252b837f10b27b0_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7642641936be02921252b837f10b27b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7642641936be02921252b837f10b27b0_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\7642641936be02921252b837f10b27b0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\7642641936be02921252b837f10b27b0_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Users\Admin\AppData\Local\Temp\7642641936be02921252b837f10b27b0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\7642641936be02921252b837f10b27b0_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:1660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD562510457be577ee4da4bb93327a0f965
SHA145f3e140ca0a079242bd76314f626554fb464383
SHA2569cc140af8b5f419b82d8e4958553c2442bd2924e561a6b27f03998a3fc51a11e
SHA512d94f729bdaf9fab5b67bc2daa3a81de21ff61535d269002045caf38f5097630fbcaf5f291d6b5a184c7e6854d181086ddcf8ba0de1bd9904ec4878e13420d822
-
Filesize
600B
MD59e5c3151a46b395e74bbccf1de7841df
SHA1ae7a5e41dabc40356adb52e85c2d05cc7436eb20
SHA256fe20a80fc730d6b50decdc4d12528d745f27f622290ca73b8e8ec652285c803a
SHA512ec84b5fca01e8d7e98921f2c468e20014938ac2c0e77cd0688718716ce10bc71f78f2e1bf9135e07570704bd652b4b4a9cad112fa78af04538f6208c1b290721
-
Filesize
996B
MD5664fb3618a67ac50db08274498a280e7
SHA1d2e89e2f08d90d62e8575257ba5efe2147be057f
SHA25676b48e915f9559cdeb62fd9b8aa440febd9d552e3a44f20b726848edc94db8be
SHA512021e70b6c577f6c1b01730351e2db94fe7a667c639752f13055b5017e15edf6a01a4d2a6d08ee82d283932b5ddaff5d55c040630548fca715e1ff17da1fb63c2