Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 01:14
Behavioral task
behavioral1
Sample
JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe
Resource
win7-20240903-en
9 signatures
150 seconds
General
-
Target
JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe
-
Size
89KB
-
MD5
f3264cbd54dee6100118b22c09a3251c
-
SHA1
4c96e95d86e72aeebcb61ceccdd22e9c9e898c33
-
SHA256
2547f2839e8bed94cb840e417e7d47670f1665ee6448b2ed98a63f5c47e85744
-
SHA512
8a682cdf585921238ccefe8c2e5a4d7c346962ff842e132eb8ed8fc675c25473705064a49a7b025fd61a44030f27d80814858f3b5c80605e34665bee8efb1bf3
-
SSDEEP
1536:xr+mFM2HXKZgixhIksu+XM5/HtAQ9Jox7e:1+4MJIkLZJNAQ9Jo9e
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\A4760E5F = "C:\\Users\\Admin\\AppData\\Roaming\\A4760E5F\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/2548-0-0x0000000000400000-0x0000000000418000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe 1716 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1716 winver.exe 1152 Explorer.EXE 1152 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1152 Explorer.EXE 1152 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1716 2548 JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe 31 PID 2548 wrote to memory of 1716 2548 JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe 31 PID 2548 wrote to memory of 1716 2548 JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe 31 PID 2548 wrote to memory of 1716 2548 JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe 31 PID 2548 wrote to memory of 1716 2548 JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe 31 PID 1716 wrote to memory of 1152 1716 winver.exe 20 PID 1716 wrote to memory of 1048 1716 winver.exe 17 PID 1716 wrote to memory of 1076 1716 winver.exe 18 PID 1716 wrote to memory of 1152 1716 winver.exe 20 PID 1716 wrote to memory of 1516 1716 winver.exe 25
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1048
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1076
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3264cbd54dee6100118b22c09a3251c.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1716
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1516