Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 13:36

General

  • Target

    e2a7e5f92c8c72c67f4c54b4c56c7bd1_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    e2a7e5f92c8c72c67f4c54b4c56c7bd1

  • SHA1

    3fbb75d1987023f41be41db9d91d4e9c9b8b8fdb

  • SHA256

    e1a0aa38de99703d1b62f36bbb1ee1a9a7e66b34e803da6cded01fa8cbb98c5c

  • SHA512

    ccee1fd89b105cef45e4c6008ec723edb7185d054120dbe5a76ac538fe12a6f29765542e8b851bda429729c2382863d4817a1b65ab13d8f8de362130e63ba232

  • SSDEEP

    24576:0SU65gZxLNjajuoLjf0Zf0T+uiYQn9PWKJ5vZUTBlQoajr6vMInYcWn:pPgDLICo/f0Zf0tiYQnkM5vOfM9IYcI

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2a7e5f92c8c72c67f4c54b4c56c7bd1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2a7e5f92c8c72c67f4c54b4c56c7bd1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\42AB.tmp

    Filesize

    625B

    MD5

    b056449c7a452c29bc12cf23820af695

    SHA1

    5b32b812e5277f6c129a1211ad6e671cf75caaa1

    SHA256

    3dad5c4e7ad24c0966a7b343394e3397c683be83e3040c53d9e396ebefe53d4c

    SHA512

    3c10e270cb752f367e752ab1293070cfb025a115399274a541f0e8a8356353dfdf08c2f6619539765318beced47fb590890dba9a7071980d14c0e07a3e2b6199

  • C:\Windows\xdfwma.dll

    Filesize

    40KB

    MD5

    e0d350836bfdb31322210f5823dcb9de

    SHA1

    b3e0ac9ac16a1a3b3a66c47509218c2e98fccd1a

    SHA256

    8dea6a462fdf0a6127e646151c4c1e51b649e6b50abe5ac1ffb5ca65fca0a50c

    SHA512

    8c7adf84c9c338d5d1d84ceed10847076ba908a2a466e7cf0781349b1a5916e17001725b3e1aab68ecf4f279db2de2cd3e3b0172cc042d21392bac668195a8d8

  • \Users\Admin\AppData\Local\Temp\dfwmahf.dll

    Filesize

    48KB

    MD5

    3f2532ea6180626395b2006ffedf7fca

    SHA1

    6634801e48a16c1c40cde9ce4cf4080984251f21

    SHA256

    0175158308879005dbb4db2bcccd4459bfbbe8a7669a6485754eeaec637ea930

    SHA512

    85fa904de2bb73b04daed671b5d58aad683600ed3e41494aeee5bdf9243408031d32628a741caff4df855e39c72d4cc9d8440e79dd69139b1cf9e3ea59676502

  • memory/1132-65-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-67-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-62-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-63-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-64-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-60-0x0000000000A00000-0x0000000000B00000-memory.dmp

    Filesize

    1024KB

  • memory/1132-66-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-61-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-68-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-69-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-70-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-71-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-72-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-73-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB

  • memory/1132-74-0x0000000000400000-0x00000000005B7000-memory.dmp

    Filesize

    1.7MB