Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/04/2024, 08:47

General

  • Target

    02dce518d9f4bb86f5b00211d13f882a_JaffaCakes118.exe

  • Size

    226KB

  • MD5

    02dce518d9f4bb86f5b00211d13f882a

  • SHA1

    d970217884b11c50f3a6da2bcdb6bf512614dfc7

  • SHA256

    1597c9e6108b149fc7af20893d240e7ad78046a90cef18cc9435cddd94da9831

  • SHA512

    fdd4cfe389fe211998591e2f1893d2dd97738cba65924499edfd124136ac711bc99f59fcafab7e9b9e926fe08de6e1dc2001cc2c0b39da6655be655688a4dbc9

  • SSDEEP

    3072:kQIURTXJqORfcc4VQgH1wOzUUUcI/CUAJkAoG0z/ZMh0FyzA59:ks4ORt4nH1zf5VUAmASzyP6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02dce518d9f4bb86f5b00211d13f882a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\02dce518d9f4bb86f5b00211d13f882a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar378E.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • \Users\Admin\AppData\Local\Temp\nso3140.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nso3140.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • \Users\Admin\AppData\Local\Temp\nso3140.tmp\inetca.dll

    Filesize

    20KB

    MD5

    134b93f8bd1f82cd2f1b06c878580703

    SHA1

    29cdbce7a2caf1f7e4d2a139c42336d490074665

    SHA256

    45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4

    SHA512

    f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692