Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 11:30

General

  • Target

    fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe

  • Size

    33KB

  • MD5

    fa33c5fd62cb1a2f3077dceea84f441e

  • SHA1

    419891ae4bff67b7c321e0d1b650926525c3c122

  • SHA256

    77722664a92042f699f0a7a8de15a0c553ecaa152d3099bf33a7beb3d4790602

  • SHA512

    cd176079d506cac51a619033e419a13bc83a8122319338b6cb895ee3157eae17d238812f35acaa58a074ed6e360ee0197fa1b6228d0081d2cfaf1772df8c2af4

  • SSDEEP

    768:6lz/yURinnljkQHMBQig88QE2vjKpCgJ6Xp6s/wJJn5Pu:izj4loW/INYCgJc0JJo

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa33c5fd62cb1a2f3077dceea84f441e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\dt.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K c:\windows\temp\r.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2652
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
              PID:2656
          • C:\Windows\SysWOW64\ftp.exe
            ftp -s:c:\windows\temp\f.txt
            4⤵
              PID:2720

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\dt.bat

        Filesize

        1KB

        MD5

        676afdfa824e13b72aecaf6d0d65fa6c

        SHA1

        f5e918c9fe29a9b432be38b812a6087f4a49bff2

        SHA256

        896520460c090bcacba8cf6f633abf2e4c6e01c8284737b60b1f51063246e72a

        SHA512

        4ac34dd1eb77862206dc608c9b57e2956857407b7c5eced45c20b6577e2d53755254fd38300a2b7d02624c37a652ade86add230cd33c452bec380688f414f633

      • \??\c:\windows\temp\f.txt

        Filesize

        76B

        MD5

        e492c90155bb26e6c57c202780f35093

        SHA1

        83d3d0a8af4fbcd3b70a22611578ef5b5966fcb9

        SHA256

        ff07e608a348217c1306a1ff202f9b91fddf104b9367c4ee911bccefe04edb94

        SHA512

        b3265b4f58966441813a0da9032d68e061dcbe6213f82b10f83addafe93627d66637105b443534fac8e074340ff50e07e14437309ad88befc774d2daf5286259

      • \??\c:\windows\temp\r.bat

        Filesize

        164B

        MD5

        f22ad73544c4463a4fe267ed2c646a20

        SHA1

        9faba5662a5f43fad4df2182fb3c45199cd316c8

        SHA256

        188e171e17dad12fa1b8067a8b86bc113c0f9df9d9ef03e89006f9c3f7c51c98

        SHA512

        2c52ceee850adbb90863452815d60596931c485c921ef1a7c3ed8d0de028cbbfc561d62e25beb63410e867da63ebfef6c7cf0f2d1cb75fe13e566731f4df2abd