Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/01/2025, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe
-
Size
847KB
-
MD5
9b288f1ed4b43253489dbd03b8902445
-
SHA1
1aaaf8dcc605ec1ce72bbadea6655ce26eb31517
-
SHA256
fe68fa8aa8522badacc0c97554cd4a1b8d466dd16dc61b86542e799db0d1f7ae
-
SHA512
e22b548195c3528869d0f67b0036fab1f95c6f74e70a8b77b829822487916e99c5fe12b49635856c667ee78a459163dbdb899c0833d9c8502246180b74096db1
-
SSDEEP
12288:TaOZoS4FJfBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLmfKWYEh2JmDt1J3y/R:QXklIKyWYI2IhfYl12Hk
Malware Config
Extracted
formbook
4.1
hs3h
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
toptenanimals.com
zambiadawn.com
muzoe.com
xtrembabes.com
nomadicfoodpods.com
sibernewskaltara.com
thelyfetour.com
sailinn.xyz
cisiworld.com
right-effort.com
emmanuelleramaroson.com
aptgdaycare.com
yanceyhomes.com
minooshargh.com
littlemontars.com
liuhemustam.com
tajaraenterprises.com
myteepathfinder.com
nectarselector.com
digitalbusinesscard.website
kirakira-woman.xyz
tntexpressdelivery.com
collectcuriously.com
marielagarciarealty.com
javierramonmartinezalarcon.com
eis-investment.com
bookanyclick.com
primespotshop.com
heatdistrict.xyz
beadedjoy.com
oyster-gal.com
umateam.com
reservadaspalmeiras-mg.com
thiramirez.info
stanfec.xyz
cowcoupon.com
humaneeventmedia.com
exquisitepdc.com
silverartandcraft.com
plomeroelectricistaquintana.com
encounterniagara.com
ram-nilu.com
standwithcode.com
sphereexit.com
alefisrael.com
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2864-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3060 set thread context of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2864 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2828 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 32 PID 3060 wrote to memory of 2828 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 32 PID 3060 wrote to memory of 2828 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 32 PID 3060 wrote to memory of 2828 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 32 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34 PID 3060 wrote to memory of 2864 3060 JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yteSoDKQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46E0.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ae35a490438b8476df1c26742c0c4183
SHA14c8d8abe11b6b8aaa3405f55efed40f5dc089bb2
SHA2561765b6b01aa07cbd974a5c7c6e1f4611bd6c934d7cce8ed06cb8c238e5ce2568
SHA5129fc1e6dc17b9c55150a77f504771c75d9f3149199e3a0d2a88f1aebf3d532587376233668219acc106c18a9844fd13b7dfd4d3c51d4705ed7460a4c67733e971