Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 05:06

General

  • Target

    f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe

  • Size

    494KB

  • MD5

    f51892f6d4ee376d5b2472d51e5a6729

  • SHA1

    e68bc433795b01e2844f70dabaf512a519daadcd

  • SHA256

    11742b1b7437e34b15baafe3e44a7cf5a14d9b149ddb87499c42dd9fdbd5661a

  • SHA512

    f878b9f065894e0fe6449c0c1ca7fee4f1aacebc8925067d4af053bd7af0972dbce9a47814d864387fad13d7dad60352596c9975a177a1111aa5e79f6f0ad92f

  • SSDEEP

    12288:mnKfyxV2ImdvPGBFfi8WuJ6+1x0KCYT88VtX0n:WKfwV2HtPgFfN9/pD4

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\n1241\s1241.exe
      "C:\Users\Admin\AppData\Local\Temp\n1241\s1241.exe" ins.exe /e 12488987 /u 52fe2c91-49dc-40b7-b209-1f140a000013 /v "C:\Users\Admin\AppData\Local\Temp\f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar35D7.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • \Users\Admin\AppData\Local\Temp\n1241\s1241.exe

    Filesize

    286KB

    MD5

    c268c937148a046322219b77c5a031b0

    SHA1

    e83ed15c7ef694a2281955a16ffeec0672c56107

    SHA256

    c913057e15ac6b27b204be58b52132d62901746075faa298bb0d08c84958d51e

    SHA512

    44cc28c7a707a37e49afdd23af42a620a8eb78f7b54913b41d8cd5eadd5ea37a6eb16e83d99dd75bbc736e70970a7c94b33d55950ed3dda45302477ea3868a19

  • memory/1748-77-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-79-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-74-0x0000000000360000-0x000000000036A000-memory.dmp

    Filesize

    40KB

  • memory/1748-75-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-76-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-21-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/1748-78-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-22-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-80-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-81-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/1748-82-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-83-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-84-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/1748-85-0x0000000000BB0000-0x0000000000C30000-memory.dmp

    Filesize

    512KB

  • memory/1748-86-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB