Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe
-
Size
7.9MB
-
MD5
f9f3468705375294fe0e98dae9f37225
-
SHA1
4b9dabacf25c95f1c0879bf3c93275e42d3e2aad
-
SHA256
8f40d4671e157a13e50d7194870918d95945cc338f867d22a0c23d879b568b7d
-
SHA512
580d5e1ad881865b804cfee4bb7fc1ba37e56b6328eb64c18ac1f44f733a6054703415455e15f9de16948e76a764b77ec21cc882bec04611745865fccef48762
-
SSDEEP
196608:87azg7DSm7azg7DSm7azg7DSm7azg7DSN:Xg7utg7utg7utg7uN
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2092 7D57AD13E21.exe 2740 Scegli_nome_allegato.exe 700 7D57AD13E21.exe -
Loads dropped DLL 3 IoCs
pid Process 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2092 set thread context of 700 2092 7D57AD13E21.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scegli_nome_allegato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2772 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2740 Scegli_nome_allegato.exe 2740 Scegli_nome_allegato.exe 2740 Scegli_nome_allegato.exe 700 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2772 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 31 PID 2764 wrote to memory of 2772 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 31 PID 2764 wrote to memory of 2772 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 31 PID 2764 wrote to memory of 2772 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 31 PID 2764 wrote to memory of 2092 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 33 PID 2764 wrote to memory of 2092 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 33 PID 2764 wrote to memory of 2092 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 33 PID 2764 wrote to memory of 2092 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 33 PID 2764 wrote to memory of 2740 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 34 PID 2764 wrote to memory of 2740 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 34 PID 2764 wrote to memory of 2740 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 34 PID 2764 wrote to memory of 2740 2764 JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe 34 PID 2092 wrote to memory of 700 2092 7D57AD13E21.exe 35 PID 2092 wrote to memory of 700 2092 7D57AD13E21.exe 35 PID 2092 wrote to memory of 700 2092 7D57AD13E21.exe 35 PID 2092 wrote to memory of 700 2092 7D57AD13E21.exe 35 PID 2092 wrote to memory of 700 2092 7D57AD13E21.exe 35 PID 2092 wrote to memory of 700 2092 7D57AD13E21.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f3468705375294fe0e98dae9f37225.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2772
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:700
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD54fa9f53d91497b5c76af71c5e8e7b7f9
SHA1d518d5a0cb52d59e68b87290f57590df718c180f
SHA2564effc4d2bbb83889491b0c07b5f3f4e740307df7ecb7ace400293f3017014693
SHA5124d98434cb9c3f46d668e20a293483ed29fbb3e1eaddf1737b3f3524a0a8d50226f49aa9d1f6648893667117b0219adaa4e6c3f944032e007a964f4e939686d67
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad