Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 14:25

General

  • Target

    e2bcdf47f34da6163a95a41b138c7a01_JaffaCakes118.exe

  • Size

    18KB

  • MD5

    e2bcdf47f34da6163a95a41b138c7a01

  • SHA1

    803c3c954d65b76f84f32694c91da2b1d782688d

  • SHA256

    7b6e4ebe021456eb221a69324dd95a2f887fce43335b1be0b884a172e816e4ea

  • SHA512

    fb4a73233563005409a97724bc7d2b43f618db7e874599ca0709146b0bf5cefe51b3c7ddb48bfa88d8e852cc4986c2d6ab7a3b5b04cfb7db43460c21f0ba30ec

  • SSDEEP

    384:ql9k1m5L4A9gqUV0zLVyPdGzrerDEsopgX069MIGn3ecQhx5IOJNxaTdHTOW/l:Ck1m5LNyq3zLVe/XFz0qMIG3enbnxaTJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\e2bcdf47f34da6163a95a41b138c7a01_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\e2bcdf47f34da6163a95a41b138c7a01_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\SysWOW64\mppds.dll

      Filesize

      26KB

      MD5

      893f945aedec568863f23e6c8b5143c9

      SHA1

      edd80272177f5d411d427e0d5bb8340b0fbe04f7

      SHA256

      7d3b86117643fdbf0911c388d2082427d0cb72cef3f3068ec65c0212ef4a75ad

      SHA512

      ceb7e97e475dd4b574e6b1245f8299835c2112b9e2fa8fced2cb06299e6d8c3fce8d2d2fd9cb5b75f3e93efc6938524aa718ed6fda2f17de83c5d680ddc2aec7

    • memory/1200-2-0x00000000021B0000-0x00000000021B1000-memory.dmp

      Filesize

      4KB

    • memory/2944-6-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/2944-7-0x0000000010000000-0x000000001000D000-memory.dmp

      Filesize

      52KB