Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 15:10

General

  • Target

    e2d061cb1b9a5e0ce3b2b4643b74d8df_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    e2d061cb1b9a5e0ce3b2b4643b74d8df

  • SHA1

    a18888d0b2685e5d2033e1ae62cbb3798287c4ef

  • SHA256

    18c6613792002a37e9ec93b449cb77b5d50c8d12e5fe3075b90d9a1660db2a66

  • SHA512

    8b339f01eed8b37b0a50bd74e4a87ad6d04c7fbe109bdab7ab4a47d0b54b794aa186887cc9b7011ebc6c293ac0312c26ebd2ac96858f579aced67c34c29b9943

  • SSDEEP

    3072:dr7ZB1IEZB44rJYtHfTyzcfMZcCUfkaNKk45q8M9t:17ZXv442HfTRYk4Q

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2d061cb1b9a5e0ce3b2b4643b74d8df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2d061cb1b9a5e0ce3b2b4643b74d8df_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Users\Admin\mauwe.exe
      "C:\Users\Admin\mauwe.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\mauwe.exe

    Filesize

    172KB

    MD5

    f914e0a06f5276067278c784cf0b018c

    SHA1

    e31ec326bb12fd10f291981f80945157563899b0

    SHA256

    69753bb91304c1fccdc454e88a54143a37b609eadcd284dd0313716e63ab5bb2

    SHA512

    84f85c60fe637f16b72b6c32ca8470170b187228cb84190aba2c55486ec37ea8205c5e3dde28062660096c3b0b5e527d1fd5b44bcf8b943afc146a84eb5aa83e