Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 15:57

General

  • Target

    faa681163770ac2f3c014ddd7e35600e_JaffaCakes118.exe

  • Size

    2.9MB

  • MD5

    faa681163770ac2f3c014ddd7e35600e

  • SHA1

    2068ec54c9388c3e7fe192a237cd1a541e7e90d1

  • SHA256

    19e52b335139c5d369786b7fa3151a1d5811dfefa690902a3dcd0cb69552ba52

  • SHA512

    1f2d84ace9605327653541e915447d727a1e91b0605dd2babfe4b75158bfdd0780225c94b247ba9e9a457ab5903271b1c186e88aae84b2621f0dcdaa77940658

  • SSDEEP

    49152:XJSyTSKdF/Uw+0lT0kC85USBX/qxh1dGIj4cbON74NH5HUyNRcUsCVOzetdZJ:XJjTSKd97FTGEUS9Cdd/j414HBUCczzc

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\faa681163770ac2f3c014ddd7e35600e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\faa681163770ac2f3c014ddd7e35600e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\faa681163770ac2f3c014ddd7e35600e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\faa681163770ac2f3c014ddd7e35600e_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2094e9e126268b9a4c8e0121fd8c7cd6

    SHA1

    3d36f44838d9df650d424255a555330dadfe1b25

    SHA256

    593f5e4b6aee021f856efd157ed9cf6b9c641a1cdbb6532f22a008f4140e3743

    SHA512

    8954679fd65389056cda4a985c0811d6aa71f4bb002d037d2e0c140e3f3efb8787eb5367d11a9453ff26b069cba040ee7aeb3971678f51d8c8d3719be1f51a56

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5c575617af24a5f9e4aac4f01eb2e24b

    SHA1

    c5fe1a70cdb207352da4ba3cbd790d5eea272faa

    SHA256

    c1f6d0aecba9ebda308533a67c104be56b98450c17a22fe7a8c6798380f78b6f

    SHA512

    9e71b769f34b412f23cb243b448f0bbd505f1a4b4bb5c92bfb2b3ed4fbb14ec4d0ce5519ffea5a756bc0160cc694465a22eca397d83902ae3b270618da4f45c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    119fc0d6cc7efeee8e53055a07d1417d

    SHA1

    ba09ab46ad83a53023d651de3b2b262bc90f626d

    SHA256

    703a9331a81750c56f04caec3137c430ff6e77fccb3903537d6ce15f82dcddc8

    SHA512

    60d78506e8b73d6c931951fadbe92e214763948bb8f038839f5898f669f6ddefff647994de573b16e16cc1cec519723e01e1e327cce44ec194a29bcb3207cc8e

  • C:\Users\Admin\AppData\Local\Temp\Tar14AE.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\faa681163770ac2f3c014ddd7e35600e_JaffaCakes118.exe

    Filesize

    2.9MB

    MD5

    eb692afaa9e4797bdc5caad0bfd22f72

    SHA1

    5030e88a0c500f92d6ea1f81ed86675a3460e4fc

    SHA256

    6c19782169abe21613b0604d0aa957aa3faf133ae6fbf9df089ea0a7a5f484a4

    SHA512

    27f705e0624938c4c9c1ea65feba7866afee970714364d2c58dab6aead2526817b2380c1f217d54808b58d13995984ee9ede8795a4bef2d61c4acc49d35abb40

  • memory/2772-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

    Filesize

    1.2MB

  • memory/2772-23-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/2772-24-0x0000000003410000-0x000000000363A000-memory.dmp

    Filesize

    2.2MB

  • memory/2772-15-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2772-18-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2772-157-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2888-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2888-14-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2888-16-0x0000000003AD0000-0x0000000003FBF000-memory.dmp

    Filesize

    4.9MB

  • memory/2888-1-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2888-2-0x00000000018F0000-0x0000000001A23000-memory.dmp

    Filesize

    1.2MB

  • memory/2888-156-0x0000000003AD0000-0x0000000003FBF000-memory.dmp

    Filesize

    4.9MB