Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 00:55

General

  • Target

    1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe

  • Size

    7.2MB

  • MD5

    1541b6a648c72b344e6f10782252e794

  • SHA1

    f31552f28d85c942e814ec2ef5d5ba32d014752e

  • SHA256

    fe6ca4391ea8f2b7fa80586a8eb9bcea47cb854cf77df05209e9df2ff61caa62

  • SHA512

    0e7ba38616ef33f4d7f587cc56089fab064574ee3c458d097750ffbec7f692bdcaf7b7ab748412d413fed713053fa3f441aa740ea005cbde6c08225ee49861b5

  • SSDEEP

    196608:TNcvvcqt7OB9qT8Cfem9J4Te4HAs8viK82ADoON+O3:+X4OWmf4TAs8qKaMOQO3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\AppData\Local\Temp\is-PDHV7.tmp\is-TKV2I.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PDHV7.tmp\is-TKV2I.tmp" /SL4 $30098 "C:\Users\Admin\AppData\Local\Temp\1541b6a648c72b344e6f10782252e794_JaffaCakes118.exe" 7345491 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-IPCTJ.tmp\_isetup\_isdecmp.dll

    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • \Users\Admin\AppData\Local\Temp\is-IPCTJ.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-PDHV7.tmp\is-TKV2I.tmp

    Filesize

    656KB

    MD5

    4fa180886ff7c0fd86a65f760ede6318

    SHA1

    2c89c271c71531362e84ddab5d3028f0756a9281

    SHA256

    1d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c

    SHA512

    a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd

  • memory/2136-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2136-2-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/2136-20-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2136-45-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2996-12-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/2996-21-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/2996-39-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/2996-44-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB