Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 08:31
Behavioral task
behavioral1
Sample
fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe
-
Size
784KB
-
MD5
fad0b3fe0036278903f8083fcec7da2c
-
SHA1
5e87dd549929aaf9d4dacb8ea94e34d9eeb9b679
-
SHA256
6be26ebc7302bd0260fe7a1cac22c2abb28f343451afcb0060d6cbc8ee2afa9d
-
SHA512
f3b1b63a62a57d633f4348625dcc153f3903e4eafbc78b26133ccc8bac816b69a8bd53f47f78b809860b128cc1134a7778434c3a8e31ef1fa9cf8a07006711e7
-
SSDEEP
12288:hG3JiXcKg1FR99rHB5IurOxFgP6dMMFp8XlfS1oKSz9xq17O2:hsKg3R9ZBzP2MSpUvNhxq1
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral1/memory/1868-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1868-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2568-18-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2568-28-0x0000000002FD0000-0x0000000003163000-memory.dmp xmrig behavioral1/memory/2568-23-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2568-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2568-33-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2568 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2568 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1868-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x0007000000012117-12.dat upx behavioral1/memory/1868-15-0x0000000003170000-0x0000000003482000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe 2568 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2568 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2568 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2568 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe 29 PID 1868 wrote to memory of 2568 1868 fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fad0b3fe0036278903f8083fcec7da2c_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5b5a9e5fb6b1e777a0f5be77c430df209
SHA1ec67b4801e04661a5878e71dcc14226739615fda
SHA256220afb4a96c296fcf13bd92165b227b6b6daf317df04579793127bfae78a5fda
SHA5122c075a9fdf2a0a2a5e9c364a5b58bc2bb2bfa07e6a4f840d5a4a016da8110232022d5e766ce3002175ec2b9468ca0cea4fc29788519038669b2333b510204ab7