Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
-
Size
80KB
-
MD5
5da3837530dd6b1a9666ea002aef5238
-
SHA1
41893ba57e61f8b177775c4d8ff982a8ec73e94e
-
SHA256
81e6145cbc93443083f2398466f3a7d39c52dcac816b92b4619576ce531c0624
-
SHA512
666fd1978741d8b4d6360bf46d93e957af5931f1777021e75ed403a125d5d9d0123410b41c88329d4595c587b125a2e85e09ec5e0f5498651d690ff344f64cd4
-
SSDEEP
1536:9HFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLg39/CF1b:9HFo8dSE2EwR4uY41HyvYLg39/Cz
Malware Config
Signatures
-
MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
-
Metamorpherrat family
-
Executes dropped EXE 1 IoCs
pid Process 2752 tmp37A4.tmp.exe -
Loads dropped DLL 2 IoCs
pid Process 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\"" tmp37A4.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp37A4.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe Token: SeDebugPrivilege 2752 tmp37A4.tmp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2780 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 30 PID 3044 wrote to memory of 2780 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 30 PID 3044 wrote to memory of 2780 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 30 PID 3044 wrote to memory of 2780 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 30 PID 2780 wrote to memory of 2664 2780 vbc.exe 32 PID 2780 wrote to memory of 2664 2780 vbc.exe 32 PID 2780 wrote to memory of 2664 2780 vbc.exe 32 PID 2780 wrote to memory of 2664 2780 vbc.exe 32 PID 3044 wrote to memory of 2752 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 33 PID 3044 wrote to memory of 2752 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 33 PID 3044 wrote to memory of 2752 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 33 PID 3044 wrote to memory of 2752 3044 JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bjxvuivt.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38BC.tmp"3⤵
- System Location Discovery: System Language Discovery
PID:2664
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5688f8ca63a4366d61fd9d22f63ab0c5a
SHA1cf6218f7700c973faf31b993b0d228c12703081d
SHA256671bce54fb69abef3092bb0191d1bbd37485a5a98406ecc7d49803a77b4b7afa
SHA51219e9fd873367fe902cba501bd79105d082f9b076de83872a4d3da16fa948e1edc506dc2bc0f6507e343c97e97814f630bef72641bc8bed18a98236871e9f440e
-
Filesize
15KB
MD5940d157842759692a6484444fa267f81
SHA171ae48d417e06c3597d3c7b0db33ef4850377b90
SHA2568666e39ef64250cc97f9a7519a8095267a841e1a8498a293501ebfbc886595ca
SHA5121c18b5efe5d87465c53f23e266c5f9e5b1794c4b2985163649d37cf8eb74089924f2f4d058dfa8f21be70870c590761c912713d7efdb53e57cdd01e329ac2e80
-
Filesize
266B
MD588511e980322352dafcaccc7e8e603ca
SHA106613e76a0b99f03d246cb6d2bdca0f07c526b84
SHA256ebdeb2f568ca90724ef6491a39a1b2eb1d917a8a62aa0e0c81522d6f99fea124
SHA512e5d5f4d62f462fcbf57544ec32fb67f0fa45074a5fcc65555e3df1d2b169db0acdf62613ce2169ef6ba68b34dccabe608b316e8b6f9f5d26f271096ae27fe506
-
Filesize
78KB
MD5396f360a9345d1360d34c0ca39d3fd24
SHA16e333e92e9fae9fbc98ec7f4c923e5f6731f4a8f
SHA256e583078ae31b379e7f01276b4f3abbca722c9346c14180401d12b71aef4a9ce6
SHA512337e1419b01e78bf8d0851494e8e7f0ca546c2027bbeb2bbad1de50090d80253c344562a9b431a445b7a19de992f2a4c05c35bb23ae9b6d88f0383101dd0ee6d
-
Filesize
660B
MD57e41bf3215bc8a6d5c8bba70735e42fe
SHA12a74cd4a3cbc0ae8084a4939553cc69ee8a86997
SHA2561b6e40e3b18580fab7f4be3c5d5a06560d373c4671e489bd2bf1313567761154
SHA512f7941273990f07659723fb4a70b49902bc6245b9eb2769599ae5b49b1f1cdafb4a7f788f26a87288d3cc3675a03501d41b89aae2b1942357ba3c022d9f0701b5
-
Filesize
62KB
MD56870a276e0bed6dd5394d178156ebad0
SHA19b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA25669db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
SHA5123b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809