Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 14:28

General

  • Target

    eb46d0218fc777642ee2bb833f3ffe13_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    eb46d0218fc777642ee2bb833f3ffe13

  • SHA1

    b8e0eb991cd826bbd8b7bb4095f5d55051ad808d

  • SHA256

    097b15bc09d99f3685f60fce0a3248c2dbf6b458dcd380d7e7d4f228b311aaa9

  • SHA512

    8df442e1a27b27f50caab9db856d409ef3b7193edada1f7e639508fcb502a4b80fe237c39cbc8d1ff3eb01ac7b1f73cdf921da8f88256b3e0c84c5fd767360c2

  • SSDEEP

    24576:Z2el+no2JOuyVNvkeKMYPPAUW//FOteTn5YoM2Z+Ga+h38tYfY2Q6w+Pq7:Z22tNvkzTXr8rTn5YoPz3oYA9S8

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb46d0218fc777642ee2bb833f3ffe13_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eb46d0218fc777642ee2bb833f3ffe13_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\is-CHJFI.tmp\is-IK93P.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CHJFI.tmp\is-IK93P.tmp" /SL4 $400F4 "C:\Users\Admin\AppData\Local\Temp\eb46d0218fc777642ee2bb833f3ffe13_JaffaCakes118.exe" 1121180 52736
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-CHJFI.tmp\is-IK93P.tmp

    Filesize

    657KB

    MD5

    3dafb498bb15d5260cb2c12b391a0d48

    SHA1

    c775ae9fdf18ab0ce38a8adffabe378f461e79a1

    SHA256

    c5d5f5f814c5bc4989d691442051e5e78cf1971eb9b773a7a26b438e58a73d7a

    SHA512

    a42f39a73bd4615490c6e33c017fa09f9992e3327d244b050b6634ad696d421170fd63ec5d5e66e92d112dc804eabd0bcd56494c9499d78fad8b46fe2ef32a31

  • \Users\Admin\AppData\Local\Temp\is-P47IO.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/1256-8-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1256-18-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/1256-21-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1632-1-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1632-17-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB