Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 19:58

General

  • Target

    fd86cf02a878fd69f1b6a8999e98a82f_JaffaCakes118.exe

  • Size

    206KB

  • MD5

    fd86cf02a878fd69f1b6a8999e98a82f

  • SHA1

    1617ff0e83f7aae3f54e46b3ca1efda6af937c24

  • SHA256

    7550a8a862d35ab55162088d7c46366f445cdf179ab427ec9d92cb7e6fbded1a

  • SHA512

    8968c38a168874a13c1bb03e5b2cfaadf283e8c708f22cb40de90b525a612f0fed3ab9fbd0afa3f321b396a384a80841f39e4391f7436ab7bc10342b69a77fd7

  • SSDEEP

    3072:DgGLWh88A0MAwaFACPvSDSR5WfJKAeUE/GLD3KRjv2ebFMZ9:NLWKlYF/imR5Wf9emvVw6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd86cf02a878fd69f1b6a8999e98a82f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd86cf02a878fd69f1b6a8999e98a82f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\PROGRA~2\WEATHE~1\Installr\1.bin\gcEZSETP.dll,Update
      2⤵
      • Loads dropped DLL
      PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\WEATHE~1\Installr\1.bin\NPgcEISb.dl_

    Filesize

    39KB

    MD5

    a5cb7459c93788bba8d897c7ae9d5cea

    SHA1

    7de68f654b08730499f9ec042ca09207d18c081b

    SHA256

    cbeb5b76abea96007540ef9883434fa3e2ba4df0b5fa33ba9126941cddf8a361

    SHA512

    58e25f366cfd83708e053c10d18561de4f13154b313cd3e3f96bf44ad2ae38482bc8900466a93d169fbde8d8dc49ae64024cee4325b890ae5466bbb14238f56c

  • C:\PROGRA~2\WEATHE~1\Installr\1.bin\gcEIPlug.dl_

    Filesize

    39KB

    MD5

    7994ff9d3fb3ac09c66f787783475ab1

    SHA1

    97ddd14cb3ea2c1e819f37ba393f76c1c7a7a1b2

    SHA256

    bb476411fac1ba9e3e5a49ad83ae1898e42324503884e28a6dd91eb0dbe8826c

    SHA512

    46a624d5184e38c6afa30d5aa6ba22a4b934e2d3adcc45130e8cc54be82ab8dc0e62ed5f1b850f3be55c5358cf8a00cb1c427d6b659065c7ba30040eeb907c21

  • C:\PROGRA~2\WEATHE~1\Installr\1.bin\gcEZSETP.dl_

    Filesize

    97KB

    MD5

    98038a2768291eb2503dd36cc1ba8472

    SHA1

    9d582cb46871ad38b8a33d7b11f45a430795e0d9

    SHA256

    ce87cbaa230e6c16a478a1cacfbfec6278cfbcf15290e86835cc35f9dd951783

    SHA512

    d28a97b3e4b6211625eedd9590651f41a027080834a8b81b0150fbf539e3726477e8943202b5e784730ac321520c2d703c150452a40870e1568da82363ebce02

  • \Program Files (x86)\WeatherBlinkEI\Installr\1.bin\NPgcEISb.dll

    Filesize

    30KB

    MD5

    9ecedb23966f76bafd3f657a8e687bb7

    SHA1

    f41a9ede091a08cb6fdac430aa2f4349b7ed4e04

    SHA256

    768bad28bdd4a658cabe129a50edff19e34e0a07c98be82d41d5e42d7cc3ebcf

    SHA512

    89dde18ae8f07836ffaf814c0cb9b7591e0f70ce70f8619fe99706778a993ed3752b103f6132f13a1b9155e677aa4218a3c69b40e13e72fe9eccbc188d9c707b

  • \Program Files (x86)\WeatherBlinkEI\Installr\1.bin\gcEIPlug.dll

    Filesize

    54KB

    MD5

    73b5ab39fb69bfda34bd3658d641d55b

    SHA1

    1815caba2ce51d84d2dcdc6a981fe0a353b6dd5f

    SHA256

    13a70cda7ef75174e973d1a4a6133ae5e2a8e457aa8d3a7cf8c4781b1431153b

    SHA512

    ff74e501fb090d16a7bfb05996c81c46e005c6e8456bbd35e4b2252b541b8bd8b54512972ad8c22364627b9f1f6a20282ba3485500f88f2918816dd65e3f7492

  • \Program Files (x86)\WeatherBlinkEI\Installr\1.bin\gcEZSETP.dll

    Filesize

    214KB

    MD5

    88b959133a061d81e35bc5d0564113ca

    SHA1

    cde67eaaa9a6ad59f1294da2fa66bfde4a3d89ff

    SHA256

    530541241d3646c1e1ba97de7e080bd9522a7e8451bf225e10b0f31e9b90862c

    SHA512

    39da0ea5e4654538774ddf282733f9a0d181b1f78f7ac16ff54182179bee875e232cbc68b2db3eece71746998e013d872b993d0763efd1e91baf534fb4160b53