Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 17:07

General

  • Target

    05abea150b2edcfcf2c5f386fdc099fc_JaffaCakes118.exe

  • Size

    227KB

  • MD5

    05abea150b2edcfcf2c5f386fdc099fc

  • SHA1

    8e5d20dba5894fadb0c2a5193ff3860faa86d53a

  • SHA256

    21b7b2b327272f9f6cbf97955a90f05e477d3317398179eb8b8ca052982850e6

  • SHA512

    0993eefd910fee63ad279d661eab00e9b9ce69c206206742cd65d77be914090c462a98e201bf5419b2074168d0a31e8e8b0e6900e94a6cf7fb66a0f5431db979

  • SSDEEP

    6144:34lwZ40243s0gJvyTZaPYZeHF/tIzi+Tk98i9goc8VRtcE:on0d8PJvyQYZelVIziveo/RtcE

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05abea150b2edcfcf2c5f386fdc099fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05abea150b2edcfcf2c5f386fdc099fc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\dfs1574.tmp

    Filesize

    344KB

    MD5

    5cfb0f8e32d3b9197bbb972bd374c381

    SHA1

    4c22e0d3b705cc55658af2cde5a62a899f513f90

    SHA256

    72ae74bf4b315a5ff9e1e7ac9a000b9b76df6492a9b1e830686c903b4b0c168a

    SHA512

    5c6c2a526dfc4ccea67a4db844c79e37d1012afa33bb9330d9c1f826ed1335c8c7f2b7bf98cd60a5625433f26a2a6cd48d279e3e32788fd1bf67ec972c9cee45

  • memory/1808-9-0x00000000047E0000-0x0000000004820000-memory.dmp

    Filesize

    256KB

  • memory/1808-1-0x0000000000130000-0x0000000000133000-memory.dmp

    Filesize

    12KB

  • memory/1808-7-0x0000000074460000-0x0000000074B4E000-memory.dmp

    Filesize

    6.9MB

  • memory/1808-6-0x0000000004560000-0x00000000045BC000-memory.dmp

    Filesize

    368KB

  • memory/1808-8-0x0000000000520000-0x000000000052A000-memory.dmp

    Filesize

    40KB

  • memory/1808-0-0x0000000000970000-0x00000000009FB000-memory.dmp

    Filesize

    556KB

  • memory/1808-10-0x00000000047E0000-0x0000000004820000-memory.dmp

    Filesize

    256KB

  • memory/1808-11-0x00000000047E0000-0x0000000004820000-memory.dmp

    Filesize

    256KB

  • memory/1808-14-0x000000000BA70000-0x000000000C216000-memory.dmp

    Filesize

    7.6MB

  • memory/1808-20-0x0000000000970000-0x00000000009FB000-memory.dmp

    Filesize

    556KB

  • memory/1808-21-0x0000000074460000-0x0000000074B4E000-memory.dmp

    Filesize

    6.9MB

  • memory/1808-22-0x00000000047E0000-0x0000000004820000-memory.dmp

    Filesize

    256KB