Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 07:50

General

  • Target

    1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe

  • Size

    3.6MB

  • MD5

    1caae598f7385ec3a7480a7dfb9e059a

  • SHA1

    236545e3b19703c942caee2d380b8f475b34b29f

  • SHA256

    15dbec53eec39a12947a6e575d5b722aeff28a0d5ae5529c20d5995f8a02c8d2

  • SHA512

    62392b4ad9b7b6cb77d11e60d8f7d0c80653aec4c469f557ac207e0b1f7df55432b779b87fe5ae8350d03c54daf238fafa80bf12f6f29c2561433a594bbf2209

  • SSDEEP

    98304:ABQPJ7Id7A6gp7b0wWxCqmLDux+9y+g5Ld43zM7xLGhGJ:ABQPJ7+7ATp7b1WxrmXu+yI3zM7RGIJ

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1caae598f7385ec3a7480a7dfb9e059a_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops startup file
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
      "C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: AddClipboardFormatListener
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe

    Filesize

    3.6MB

    MD5

    1caae598f7385ec3a7480a7dfb9e059a

    SHA1

    236545e3b19703c942caee2d380b8f475b34b29f

    SHA256

    15dbec53eec39a12947a6e575d5b722aeff28a0d5ae5529c20d5995f8a02c8d2

    SHA512

    62392b4ad9b7b6cb77d11e60d8f7d0c80653aec4c469f557ac207e0b1f7df55432b779b87fe5ae8350d03c54daf238fafa80bf12f6f29c2561433a594bbf2209

  • memory/1756-18-0x000000013FA60000-0x00000001403EF000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-20-0x0000000002BA0000-0x000000000352F000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-3-0x000000013FA60000-0x00000001403EF000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-4-0x000000013FA60000-0x00000001403EF000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-5-0x000000013FA60000-0x00000001403EF000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-1-0x00000000774D0000-0x0000000077679000-memory.dmp

    Filesize

    1.7MB

  • memory/1756-11-0x000000013F0F0000-0x000000013F100000-memory.dmp

    Filesize

    64KB

  • memory/1756-0-0x000000013FA60000-0x00000001403EF000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-2-0x000000013FA60000-0x00000001403EF000-memory.dmp

    Filesize

    9.6MB

  • memory/1756-19-0x00000000774D0000-0x0000000077679000-memory.dmp

    Filesize

    1.7MB

  • memory/1756-22-0x0000000002BA0000-0x000000000352F000-memory.dmp

    Filesize

    9.6MB

  • memory/2560-26-0x000000013F6F0000-0x000000014007F000-memory.dmp

    Filesize

    9.6MB

  • memory/2560-25-0x00000000774D0000-0x0000000077679000-memory.dmp

    Filesize

    1.7MB

  • memory/2560-21-0x000000013F6F0000-0x000000014007F000-memory.dmp

    Filesize

    9.6MB

  • memory/2560-24-0x000000013F6F0000-0x000000014007F000-memory.dmp

    Filesize

    9.6MB

  • memory/2560-27-0x000000013F6F0000-0x000000014007F000-memory.dmp

    Filesize

    9.6MB

  • memory/2560-28-0x000000013F6F0000-0x000000014007F000-memory.dmp

    Filesize

    9.6MB

  • memory/2560-30-0x00000000774D0000-0x0000000077679000-memory.dmp

    Filesize

    1.7MB