Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 13:52

General

  • Target

    f5ecdb3827c20e123ac28d4ef26a533d_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    f5ecdb3827c20e123ac28d4ef26a533d

  • SHA1

    4bf357cd1f834c8528b533ebf419f0e21d5d8f95

  • SHA256

    9234b17eb238b9cbac896b8424a424d0043c25e5c52ba584ef9616f6f990e7d7

  • SHA512

    460defcbca907a38c60670f5474f8f6bca30bbaff5e92a01d6267a62f2e0dc38256bfe8cbf30781f6158d8af0e5f2313a9ed26908bb5fc75a1d58cee0373c125

  • SSDEEP

    24576:k072LCRL7NOV4OREd2l2QAlQEIt+LkR41p7Kkbg6+PsyxM44waCPIqWP2gJvG:177K//l2XA41p7VmUyxM44waCPf

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5ecdb3827c20e123ac28d4ef26a533d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5ecdb3827c20e123ac28d4ef26a533d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Users\Admin\AppData\Local\Temp\f5ecdb3827c20e123ac28d4ef26a533d_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f5ecdb3827c20e123ac28d4ef26a533d_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7a3235e929a96b236ff5ede608abd19d

    SHA1

    4aa0a57cf3e0b348c6f3fdff8bcd9483ee8b96c3

    SHA256

    9e011618a0f392c9fa0eae26c95d7e6e3400bec2059ddd7133b8cf05912fd2bd

    SHA512

    414ff031a527888fa68d45d9dc11d8c81d03978bb7cc77c68555feea22cd9f99074cdbb5f7a4ebdd4aac755e72cb84b3e73576e3c7eb83fdb9be031628457054

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b0f93b4980dccd53f9ee11bb8defac2a

    SHA1

    e792b28c6f6c2da708adcf7522a87442af616934

    SHA256

    b4f43c3d683af3b91cf055d9ce9f28e36b879f551286583516f0e5f67eeb9411

    SHA512

    fd63444b9c1c2eccdc126bb08f709c03be628e4fa0442add10638576df516952660a593c16a5a7e397d23ef46e282abf3e8b8a19a12e4a6c3a711ae661e0ca18

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    92d7694dc2460db7990a9b4f99096fc9

    SHA1

    04c8e526cdf7f0189e4e3b4e7e2b643572ca8066

    SHA256

    057a2fbbe1c6e82cc86ce0dae13a75a89915d51c37f78fbbf8b3f95a47886512

    SHA512

    bb7b69dee53221346255babe7d6e19deebc6dca42a90402d3d34a2d983da9dad9f585ba610441bde46afe5d0daf5e11505d6e95602411eb36bd466a66ff37abd

  • C:\Users\Admin\AppData\Local\Temp\Tar16FF.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • \Users\Admin\AppData\Local\Temp\f5ecdb3827c20e123ac28d4ef26a533d_JaffaCakes118.exe

    Filesize

    1.3MB

    MD5

    b95067fef87aaae47f3287ff5a5c56c7

    SHA1

    eb9a75b7208ea5fc8e4324a5ba181c0fdf029e1a

    SHA256

    96e45c8a74389f0b47dceafca6c24485cbfd2f9ba0bb2afb1a89c2429e495e93

    SHA512

    d2b1070123523662350a83b42517b1091bd3c648d40eb861168c5ab5831c374f54a9a3b5371d12d3b5f174aa69691acd173ecc6397160217849e838047488e64

  • memory/824-14-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

  • memory/824-0-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

  • memory/824-15-0x0000000003580000-0x00000000039EA000-memory.dmp

    Filesize

    4.4MB

  • memory/824-2-0x0000000001A60000-0x0000000001B72000-memory.dmp

    Filesize

    1.1MB

  • memory/824-1-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

  • memory/2340-20-0x00000000002B0000-0x00000000003C2000-memory.dmp

    Filesize

    1.1MB

  • memory/2340-17-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

  • memory/2340-18-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

  • memory/2340-164-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB