Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 13:19

General

  • Target

    fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe

  • Size

    116KB

  • MD5

    fcd97c39ece3d921ef167515efb5ba15

  • SHA1

    4a8d7e10b9018c92d9bb338152df8a4333936839

  • SHA256

    e1497fdc141ec6db3bf03a6df176c51b11443895dbe8f02abd7a874454dfa621

  • SHA512

    85ac0701ae3389413f8957b89e772b3d11375f9ef73e072dfb0b01dfde52d425b4cc15d11726ab6468dec57ba8878bc216720e87b978ad82c9f500dff8d77379

  • SSDEEP

    1536:e8MFN7qNlfNe+zLipk+JOmuvBGVa/TYareDRRdauTZ8yEnm+Ad4gricMsR:Cb7q71LzLikOupGVgeDsuTZAo4lsR

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fcd97c39ece3d921ef167515efb5ba15_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Swf..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:1124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Swf..bat

    Filesize

    238B

    MD5

    135734325998f8ccad9e39473c0420cf

    SHA1

    40d63174c6da265f540f9eabbbb9b23b29587d2d

    SHA256

    7cb8fea3b052e201bfc24deb1086e6c69268d2d814643f678c49158ce50b861f

    SHA512

    4da6c3a2923dcb271d53cb6a69e13ea6e1a44882e994c0475319ae93ee8e031da8aa3314177bef8fac05f2179f68d10d3012731db58defc9980fe71f52a883f0

  • memory/836-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/836-1-0x0000000000190000-0x000000000019C000-memory.dmp

    Filesize

    48KB

  • memory/836-2-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/836-4-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB