Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/01/2025, 16:20
Behavioral task
behavioral1
Sample
JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe
Resource
win7-20240903-en
8 signatures
150 seconds
General
-
Target
JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe
-
Size
160KB
-
MD5
ccb96c1c27772422a8b12a701dd20513
-
SHA1
1cfac3318b08a72017cf17162dd66c8029de25b0
-
SHA256
8d4aa7c67142650ddb1ea7175a9e5a404d2ec959eaa6e4b7db9f78b897d70719
-
SHA512
30bf0ddee1e4ba9cd21ddf45d5a672f1e2025296490c81e2b6567fd9306c7597b1fb77e1749809022959261f72f5202f527bb94db74ddeeb3f1016a6b724f219
-
SSDEEP
1536:rEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:YY+4MiIkLZJNAQ9J6v
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\128D1417 = "C:\\Users\\Admin\\AppData\\Roaming\\128D1417\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/3020-0-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe 3060 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3060 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3020 wrote to memory of 3060 3020 JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe 31 PID 3020 wrote to memory of 3060 3020 JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe 31 PID 3020 wrote to memory of 3060 3020 JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe 31 PID 3020 wrote to memory of 3060 3020 JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe 31 PID 3020 wrote to memory of 3060 3020 JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe 31 PID 3060 wrote to memory of 1196 3060 winver.exe 21 PID 3060 wrote to memory of 1100 3060 winver.exe 19 PID 3060 wrote to memory of 1156 3060 winver.exe 20 PID 3060 wrote to memory of 1196 3060 winver.exe 21 PID 3060 wrote to memory of 1556 3060 winver.exe 23
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ccb96c1c27772422a8b12a701dd20513.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3060
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1556