Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 04:20

General

  • Target

    2847aee524dcddbf33fade6a4dd12a45_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    2847aee524dcddbf33fade6a4dd12a45

  • SHA1

    e7e94fd76b1cd0dd40b40a7d14ea64db0e2ad016

  • SHA256

    2d0c69c0abbb080a635a97af58cfd710abf3eadf83dae363c7dcc62204b62171

  • SHA512

    7fa875101ee474b0a6ebd10cd3a886d30f9eaa61877fd629d8c187b5c5570b5a4e84ba648f12a8799d63f91d8e81a6ab2c9c6e2c38c1b0d2152332670820c173

  • SSDEEP

    24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFS:Kwi0L0qlFwi0L0qlGP

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2847aee524dcddbf33fade6a4dd12a45_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2847aee524dcddbf33fade6a4dd12a45_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.exe

    Filesize

    1.0MB

    MD5

    33767234ef1abb1457b3315404660060

    SHA1

    b4c385193fecbbd25a16af30d6723bab7ec7f724

    SHA256

    e6e28241a3ee81e6158d8ee91da25f745bf7b129d181a072c6056281b2d818fe

    SHA512

    5936d9f4338df4f322715da575277282fa18689e743ad070decf16c5ac2e33636ccdce8424108644f2eec9081c478b48b78d40f8d6e9fecce50964acbf050467

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    950B

    MD5

    03e2eb2d605daeedacefd535bd1ac92b

    SHA1

    479ad53884e98743a48ae666c3c21a4bdc4303a4

    SHA256

    6b02346ab1d92be0f40dabc83e33e4083cd4e8263605b7c6aa7e32cb546ff0a0

    SHA512

    8714545af006f20bb87b228f563701e60421a9a9eed2ccaa67c08f026eca0f76862df7f7ae6de4338d31398f0aed3451dc0a77811dc879d8924f8fb65ed4792a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    955357b23420209166d274bed34e9bd3

    SHA1

    8964763ce795041fca1dd28c95dd7777e1211a1a

    SHA256

    2b05ae219ff453cd4c56645757cd8255cdb385204c761a98ad97e3bc0b62ef43

    SHA512

    7141b6e3a90f94e9cb744a975e1032a40ad4fc0722b93050f1ff5f3654a54a7ce28cc24ad64270d33978521bcf9809a01666dba2ed8bc212c00cd475f1bff2f5

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    1.0MB

    MD5

    2847aee524dcddbf33fade6a4dd12a45

    SHA1

    e7e94fd76b1cd0dd40b40a7d14ea64db0e2ad016

    SHA256

    2d0c69c0abbb080a635a97af58cfd710abf3eadf83dae363c7dcc62204b62171

    SHA512

    7fa875101ee474b0a6ebd10cd3a886d30f9eaa61877fd629d8c187b5c5570b5a4e84ba648f12a8799d63f91d8e81a6ab2c9c6e2c38c1b0d2152332670820c173

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    866KB

    MD5

    c378c77f977bf63d6a1b6d6ea8247bd3

    SHA1

    73053ce4027e3f530979e4f23f82e547520bd442

    SHA256

    610250bec271b8072d9f6b6a1373f413022dcb5b687336d73f5f3559b4d1139d

    SHA512

    92da359260afe58a6455c50428e30248f9a6c2ed81c1d385898bb65a5f010fba1035e69d454a77106b741856f6f2bc40590b7686b324ae8ec6c80b446ddf6362

  • memory/2224-340-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-326-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-350-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-360-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-238-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-300-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-248-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-228-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-260-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-320-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-270-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2224-280-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-310-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2224-290-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-271-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-291-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-301-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-281-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-311-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-321-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-261-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-249-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-327-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-239-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-341-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-351-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-229-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2424-10-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2424-361-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB