Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 16:48
Behavioral task
behavioral1
Sample
JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe
-
Size
150KB
-
MD5
6e092b58c6215f860f0255f3fb5f2f83
-
SHA1
3bb49785892deafff5c8ee6b05c95aa17466d3f2
-
SHA256
2770111e9c78bdad80466d60982f0d3f576e051dc8c566d504a1c59cce0a33d0
-
SHA512
2547341fe729b7b9344b65c9b093ab067fd9b0f7108a9d5c2f94724ddd7a09998f95185b65b5edfc6f3cd160f05332c89b870ca89ce9d5c1372f406855468a1a
-
SSDEEP
3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwM:H29qRfVSnt30Bbt+IhDFM
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula family
-
Sakula payload 6 IoCs
resource yara_rule behavioral1/memory/2900-0-0x00000000009E0000-0x0000000000A0F000-memory.dmp family_sakula behavioral1/files/0x0008000000015d81-2.dat family_sakula behavioral1/memory/2628-7-0x0000000000EE0000-0x0000000000F0F000-memory.dmp family_sakula behavioral1/memory/2900-12-0x00000000009E0000-0x0000000000A0F000-memory.dmp family_sakula behavioral1/memory/2628-13-0x0000000000EE0000-0x0000000000F0F000-memory.dmp family_sakula behavioral1/memory/2900-14-0x00000000009E0000-0x0000000000A0F000-memory.dmp family_sakula -
Deletes itself 1 IoCs
pid Process 1500 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2628 MediaCenter.exe -
Loads dropped DLL 1 IoCs
pid Process 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1500 cmd.exe 1656 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1656 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 30 PID 2900 wrote to memory of 1500 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 33 PID 2900 wrote to memory of 1500 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 33 PID 2900 wrote to memory of 1500 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 33 PID 2900 wrote to memory of 1500 2900 JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe 33 PID 1500 wrote to memory of 1656 1500 cmd.exe 35 PID 1500 wrote to memory of 1656 1500 cmd.exe 35 PID 1500 wrote to memory of 1656 1500 cmd.exe 35 PID 1500 wrote to memory of 1656 1500 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e092b58c6215f860f0255f3fb5f2f83.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1656
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD56bd09b50ce97312af5d70addbadbb06f
SHA10d5ae33839da04e3780e918cc6c3b3ad871b8be4
SHA25688db863f6f74dc1e51d99f926d5fd74dcdd1fa2c100b0f9743ee29cd062d32f5
SHA5122d57627c7176fc57856232a979999dee7275a18cca6d763d40ac2122deb926a02378dd74abf83bf689b30593fbf3aa1c148a4e73349b96e0b411abf336182486