Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 14:45

General

  • Target

    e2c5b227b63fdcb06b7ed7e6b1ef453d_JaffaCakes118.exe

  • Size

    207KB

  • MD5

    e2c5b227b63fdcb06b7ed7e6b1ef453d

  • SHA1

    5d082a6dd013b03e3cb2645813220bd8cfe221a6

  • SHA256

    3a8b0c66b39809faeca7d8e618b88e15bf0ad5cceea7799ab93034127834280a

  • SHA512

    ca5bae235c5896f538a5a3d49ed30d90940bcc509155aab10dabfcf37e78e9dd8f8cd33ef65d1ec8ddd06ff7400a38dc61bd8aea973db793c9c1d265bbc24669

  • SSDEEP

    6144:dyDhODiJ4hfV4uRxnwei8ej0EJfhs+5kKFVBfKKnsl:dymx4uR9JejNt+4VB1e

Malware Config

Signatures

  • Disables taskbar notifications via registry modification
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2c5b227b63fdcb06b7ed7e6b1ef453d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2c5b227b63fdcb06b7ed7e6b1ef453d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\nfp.exe
      "C:\Users\Admin\AppData\Local\nfp.exe" -gav C:\Users\Admin\AppData\Local\Temp\e2c5b227b63fdcb06b7ed7e6b1ef453d_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2932
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\nfp.exe

    Filesize

    207KB

    MD5

    c09d12b2ab052ed3ae1d9b4074f5c256

    SHA1

    24b2c5188a1f902712ad3034f90ecd4f1c131b7e

    SHA256

    48acea765828f08c93209177ffc54ff44367ec61819e8aa39178087be3d79dc0

    SHA512

    7046fab6e9c39bc36b0989607aaf77f945bfbc2a1819f7a57e51fabc8f390f592ee0e9a8f239d5c97db7f190fdbaebcaf3aad48a70bbcdbe570d791d961f37f2

  • memory/1956-24-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/1956-1-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/1956-2-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1956-4-0x00000000002F0000-0x00000000002F5000-memory.dmp

    Filesize

    20KB

  • memory/1956-6-0x00000000020B0000-0x0000000002367000-memory.dmp

    Filesize

    2.7MB

  • memory/1956-5-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/1956-8-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/1956-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1964-56-0x0000000003250000-0x0000000003260000-memory.dmp

    Filesize

    64KB

  • memory/1964-32-0x0000000004490000-0x0000000004491000-memory.dmp

    Filesize

    4KB

  • memory/1964-25-0x0000000004490000-0x0000000004491000-memory.dmp

    Filesize

    4KB

  • memory/2932-26-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-37-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-22-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-27-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2932-29-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-30-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2932-21-0x0000000000280000-0x0000000000285000-memory.dmp

    Filesize

    20KB

  • memory/2932-33-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-35-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-23-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-42-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-44-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-46-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-48-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-50-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-52-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-54-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB

  • memory/2932-19-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2932-57-0x0000000000400000-0x0000000000604000-memory.dmp

    Filesize

    2.0MB