Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2024, 05:51

General

  • Target

    f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    f2d307d511598d28277a04c237bf43e3

  • SHA1

    4e62c61d4e27d47521ddb292cb6663c8e70710b3

  • SHA256

    03afd31516a921baa87cffe44953c60db80b9b33edda8c122ba01aacccdae1d7

  • SHA512

    0d509e13a47ede8ea0e9fff9890e5dbd0f7dbda52a5e847a99fa31da8ff34486a3ecea8ab82db1ad053f02d0151e6338215096c7509eba897bf6ef12bcce01b9

  • SSDEEP

    24576:8OziV6WrXt0Se4Ck2JDbzLvMJcjukL2aNc14RxVDW7K5lAleicjukL2Y:8YWrX7jCk2xMJcakLXNckxk7K5l8eicl

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe" /TN ZBrUCVBB2555 /F
        3⤵
        • Creates scheduled task(s)
        PID:2660
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN ZBrUCVBB2555 > C:\Users\Admin\AppData\Local\Temp\crZWYnxK.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN ZBrUCVBB2555
          4⤵
            PID:2804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\f2d307d511598d28277a04c237bf43e3_JaffaCakes118.exe

      Filesize

      1.5MB

      MD5

      114709628715369b7a6f30eed309cefd

      SHA1

      299615af14dbd2e6d91544330c265698f111c115

      SHA256

      ef8cc1ef52a6ae618abb12828728afd5b46bfed6aabc7324cc586efec5c87d21

      SHA512

      228b3e730f6d3f1b87e422a0e0c85312b70e04b0a777ac0e1b24e73d05bab2d9cbb3f40367499ac14b490a151d8538c69c374c5ee0cf28f8bf4b4e6f2d81ed38

    • memory/1288-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1288-2-0x0000000000290000-0x000000000030E000-memory.dmp

      Filesize

      504KB

    • memory/1288-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1288-17-0x0000000023180000-0x00000000233DC000-memory.dmp

      Filesize

      2.4MB

    • memory/1288-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1288-53-0x0000000023180000-0x00000000233DC000-memory.dmp

      Filesize

      2.4MB

    • memory/2224-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2224-31-0x0000000000390000-0x00000000003FB000-memory.dmp

      Filesize

      428KB

    • memory/2224-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2224-21-0x0000000022DA0000-0x0000000022E1E000-memory.dmp

      Filesize

      504KB

    • memory/2224-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB