Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 14:18
Behavioral task
behavioral1
Sample
fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe
-
Size
784KB
-
MD5
fbdffbc111594fa5c33c352de4cb5d05
-
SHA1
492819ac92bf5bd889aa393eaa83b8df831bcfa5
-
SHA256
5729b4350a6375426d6c33e4c13941c42440951486d15a35bb07904d8fe27050
-
SHA512
4212be741d3c396fda13499dd56b67554254582379045f1cac5331b3f4dafd2ec025a153ffb93121c23976091eb03ebaa9ab10084a493a52e1b5f72cc9724386
-
SSDEEP
24576:Q4i+/AriMtyujCVMdIyQ6VjtG9UqOgp77:Qc/siMtxjUMwy4eqz
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2076-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2076-15-0x0000000003220000-0x0000000003532000-memory.dmp xmrig behavioral1/memory/2076-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2684-18-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2684-24-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2684-33-0x0000000003150000-0x00000000032E3000-memory.dmp xmrig behavioral1/memory/2684-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2076-35-0x0000000003220000-0x0000000003532000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2684 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2684 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/memory/2684-17-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000c00000001226d-16.dat upx behavioral1/memory/2076-15-0x0000000003220000-0x0000000003532000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe 2684 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2684 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2684 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2684 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2684 2076 fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fbdffbc111594fa5c33c352de4cb5d05_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD57c792816db0fd3f9873688df6f2714e6
SHA1f5c845c932892c72462a92bded3abed7f71527be
SHA256e90189b3bb372e5ead68748f0fcfe1c3aef5a70b4c46e2776e857b10a76e8d5c
SHA512f3e01ea72dd833448d993b781ee4709eea0ed78bed175ced4ba70ac8a7f09c0f6a542db092cb822dae11a261ce22b11e46277524c6a8ab6f28e050e214becd7f