Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 18:15

General

  • Target

    e58dd8f61151a54bfa678ddf428009e4_JaffaCakes118.exe

  • Size

    7.9MB

  • MD5

    e58dd8f61151a54bfa678ddf428009e4

  • SHA1

    52602ce35b7baf50a55ec1ece9a50733973afc01

  • SHA256

    5a219dd672a2893e8d89222da783e1c83780fb6fd2daca5355439505aeb5682f

  • SHA512

    6bb579a71196f1f8a2e55e87f0c7c4a1df1c482a2764ac3df6e685218f6bf85215abbb47126bcba1f0f8ce4ee389c4ee63ceb40754c73241bfabf2155bb328c7

  • SSDEEP

    196608:0dazg7DS8dazg7DS8dazg7DS8dazg7DSv:Rg7uJg7uJg7uJg7uv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e58dd8f61151a54bfa678ddf428009e4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e58dd8f61151a54bfa678ddf428009e4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:2604
    • C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
      "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
        "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2792
    • C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
      "C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\7D57AD13E21.exe

    Filesize

    7.9MB

    MD5

    eed15422edc954ce5024b531cb32716b

    SHA1

    2b0c73bffa73cef621398797465cd1251a136f0f

    SHA256

    857ca32f0bd6b38993cdd091d12f9f07af2794fbca6a7779a815328469890671

    SHA512

    e2743353503de81cf0f55ffb34889ab62b3da7ce9691a3693110bd2b0043bd47cc04680110939740e538a3b23a0e0d7a621db7b21bf3f4a9317ee868ca26f2be

  • \Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe

    Filesize

    1.0MB

    MD5

    a2f259ceb892d3b0d1d121997c8927e3

    SHA1

    6e0a7239822b8d365d690a314f231286355f6cc6

    SHA256

    ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420

    SHA512

    5ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad

  • memory/2124-1-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/2124-12-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/2124-19-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/2124-0-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/2696-42-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/2696-13-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2696-50-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/2696-40-0x0000000000400000-0x0000000000601000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2792-52-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2792-49-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2792-45-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2792-53-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2792-56-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2792-55-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2792-58-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2792-61-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2828-41-0x0000000000400000-0x00000000004FB000-memory.dmp

    Filesize

    1004KB

  • memory/2828-24-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2828-21-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2828-54-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB