Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 14:48

General

  • Target

    e2c6e0fe3b1d2b33196db7c8910583db_JaffaCakes118.exe

  • Size

    756KB

  • MD5

    e2c6e0fe3b1d2b33196db7c8910583db

  • SHA1

    938e6ac51fb2693367694fc1777e9f2310073613

  • SHA256

    1eba046e573d6710293d85856769feebed1e6a27b4285b5d3fc1bb1dc3c2744c

  • SHA512

    7242201d1068bdbf079756c2b8337c782df32386fe40ba05f7787efe84f619fad068c7c5bc3d52b8ada9b1e941d9ee43fa86aebd439a068c46eaea9fd308c356

  • SSDEEP

    12288:Tp4pNfz3ymJnJ8QCFkxCaQTOlOb47MMpX:tEtl9mRda1rMMpX

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2c6e0fe3b1d2b33196db7c8910583db_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2c6e0fe3b1d2b33196db7c8910583db_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.exe

    Filesize

    757KB

    MD5

    5b1e0e077864227c31d0d7451b99482b

    SHA1

    6da651d0e473da060bbc9080c30242394286327f

    SHA256

    5f9b29b657ee53c9658a661fceffa7c24929e2308625e594767e86cca0029673

    SHA512

    1e3cd6ce023cd0cb9a98c3785824b578ad64292ae0f304a328d4c175b91b4dde6f7ea5bc592d1650da281f4972216db239d9fa78b999352b6c9ebad55d32e539

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    ce9550af7e6c399d4a96cb800af232aa

    SHA1

    90ce512584c334d4131833790a590497310717d7

    SHA256

    9e334a843ad659e10ab4c5d85fe6b91447a6e7c99c88af4224783f73260644da

    SHA512

    52c2c15fd8bdfbe0816b34d98d70f13abad9f2f0f851bb96128767f617e16c8b577499e1192e1ffd3e27fc9e3903837435eba3799374cf0f9d9064f913242145

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    8cc067ff565d6ee65056d7282fab5373

    SHA1

    af23b6ed89b9bdbbc62df7f19802288cd55b80e2

    SHA256

    5a911fe6efd383c7de3a15a1e89dd2168f42f0231a5231dd354f9920955a2290

    SHA512

    2f427321c55abe27bae9e9ff32b420e8e3812f795cecb32633d708fcddcab0ec862c219c5db4868e486d5ab9875a86c99705e13a0b77f5fbc30852e81f71702a

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    756KB

    MD5

    e2c6e0fe3b1d2b33196db7c8910583db

    SHA1

    938e6ac51fb2693367694fc1777e9f2310073613

    SHA256

    1eba046e573d6710293d85856769feebed1e6a27b4285b5d3fc1bb1dc3c2744c

    SHA512

    7242201d1068bdbf079756c2b8337c782df32386fe40ba05f7787efe84f619fad068c7c5bc3d52b8ada9b1e941d9ee43fa86aebd439a068c46eaea9fd308c356

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    756KB

    MD5

    e54120ffa7565821f4ba0f91f0b68c76

    SHA1

    eaaa2f1fbdc5d1c6b6e7cd0f056393be18fc35e0

    SHA256

    ac0f3b521822a9e47ffa1150074d3ed5b9ee3c44d3aacb512bbe1ae22e84f696

    SHA512

    f4029c137e3ea7af3208ad4cd1e5a66e8b47b1f5a15ab5a0aefd087898e0b6c8a70662513248b63ec183aa2e2bdc754549ee944ae215e63eaa1f601f08f77ad6

  • memory/1996-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1996-236-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2772-10-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB