Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 22:10

General

  • Target

    26f7e5c5148dd565538cf01247b4c48a_JaffaCakes118.exe

  • Size

    312KB

  • MD5

    26f7e5c5148dd565538cf01247b4c48a

  • SHA1

    d664d6ff18e1ccf7e52af73e46d712b76ec51de6

  • SHA256

    2365a790e2be885b9f4c22de9648cd082252013ba5141548ad414d5524146c62

  • SHA512

    35fe538375f70ab684d9f9ffceda45d7b0e4644afb0f53b9bb35e443af6a19741a4365d1e961021c2ebce4059ee6a6fef3b045d4ec88a57f647eddbec7779da9

  • SSDEEP

    6144:sweks+CRE0mfLS8zW1Osdnp1PuJ93ZLYG:peknCO0mzS8Unpa5

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26f7e5c5148dd565538cf01247b4c48a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\26f7e5c5148dd565538cf01247b4c48a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\bhs14A9.tmp

    Filesize

    242KB

    MD5

    46abad63ed5a1a264515f158a08dd410

    SHA1

    96bf993cbf8245c2adcdf305f6f8b2e2579f5707

    SHA256

    7df243e7fef0e6894b7b5ca9ed12598c61ad92706d54b795c871ff32559199e7

    SHA512

    17d6d52b04ee0d29aa18ec7eacf468cf62414479165ce11bef23e1446780611ff41fb1f2b596f34e67c90e691d3ddece87f9acf26c4569b28df3d8dbdaa58243

  • memory/1920-7-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-3-0x0000000000450000-0x0000000000492000-memory.dmp

    Filesize

    264KB

  • memory/1920-4-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-5-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-6-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-0-0x00000000742FE000-0x00000000742FF000-memory.dmp

    Filesize

    4KB

  • memory/1920-13-0x000000000AFE0000-0x000000000B786000-memory.dmp

    Filesize

    7.6MB

  • memory/1920-18-0x00000000742FE000-0x00000000742FF000-memory.dmp

    Filesize

    4KB

  • memory/1920-19-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-20-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-21-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1920-22-0x00000000742F0000-0x00000000749DE000-memory.dmp

    Filesize

    6.9MB