Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2024, 08:04

General

  • Target

    f30d143f9d5273dc215d8200ca77ec93_JaffaCakes118.exe

  • Size

    304KB

  • MD5

    f30d143f9d5273dc215d8200ca77ec93

  • SHA1

    a1dd6650edc8e4802094b634f93e87c6a06ef632

  • SHA256

    121bb631a003a8ac810e98f36be273ddc3c5e3f8127c3d6e9db1ea3b63d0df14

  • SHA512

    d4db62a10dc90665d9acce45a44ee5148fcf2ca69cbea9814119dc5cd3440ec045ac6c44f94526387fe918f80dd931fd82d7eb59c7398e5b1308af1d87845e4e

  • SSDEEP

    6144:Lrkx9uEo2S1YnQmCX492DkwNP3qpYFkXdlP5IO5/OoCVHuy6SHZ86riVZkiizFb:LrkHu6/eIo4RXdrIO5/OpVHd6Ky6rizM

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f30d143f9d5273dc215d8200ca77ec93_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f30d143f9d5273dc215d8200ca77ec93_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu37EDFF77.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{92DE9C35-AB05-4FC3-AD28-E327493DBEC3}\Custom.dll

    Filesize

    73KB

    MD5

    e8d86c771d7e23b080921b9803f1654c

    SHA1

    49d8ef6835a6de734ead4e0b2cbbc65735cd5c17

    SHA256

    cc7a340bffc39d8d8f704314f0383404590438b8cd16e780e0a26723bceedd21

    SHA512

    b9902e0112bbf053ec4e3aa633ac2f2dd938b23507ff58ed69ac580656e42874c4b0ccb0d393b26637ae2b98feee78023d62378adb99140736e314de74fb399b

  • \Users\Admin\AppData\Local\Temp\{92DE9C35-AB05-4FC3-AD28-E327493DBEC3}\_Setup.dll

    Filesize

    167KB

    MD5

    262cc5a5e5a007ae182c45e41ac35adf

    SHA1

    999582209e73d92d0040b8092666087aac2cee90

    SHA256

    ecc186e0284593db51463f104ba8486b1de656d47a290d27c6fea157cb1495bd

    SHA512

    2f59e23646774c3e5034d464242ac128cfb3ced1a0498dd0f719308b5854fbba20d457127e01b414f12b63d8bc3baf7ffcf89d91300ca43b90ed6cc933e4bd5b