Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 12:40

General

  • Target

    2a033f914ebbb0c8df9bb9effdf72f57_JaffaCakes118.exe

  • Size

    826KB

  • MD5

    2a033f914ebbb0c8df9bb9effdf72f57

  • SHA1

    2c488218f8cf04b73db42c854bc348c0a994de7a

  • SHA256

    8539991f73b64de58635102b1b5fb2c0b740e867d3d9d62ebb711ab610c296fe

  • SHA512

    9459e42417278f4ec66f18f880e20835d6f58a4655ef1d38c5b63746a3ae2333d14a7ba269f77fa608cfc597a711fb389e22943a2cbe3f92021f79c22e53d4d0

  • SSDEEP

    24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvX:oEs1h5

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a033f914ebbb0c8df9bb9effdf72f57_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2a033f914ebbb0c8df9bb9effdf72f57_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.exe

    Filesize

    826KB

    MD5

    0686a2ba10f9cf44b29e297f623de09e

    SHA1

    044d298c1c967209c13c2bd809afe529048aa3c9

    SHA256

    d9a2da4ac2d4f657134d98ea9ceb09e036ea35c127a9600bd8e96f196ef49ba6

    SHA512

    011a0c66a9699da534d4d20a1c2dbda652e56fad74613572a549da4061cdf14c8941c05201ecdbed20b2308c8a00cb12286467f4aa64180e2c31bd2839a3677b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b39b4f0e69c4be7944792e7d91a5c25e

    SHA1

    f18f7af7e2ca6325e3a71e51ba51d73442d5be95

    SHA256

    e5e2678f778a4507ab72c15468c24d1e2ffa0560a3736c6cb2bfee4c36d1d93c

    SHA512

    b75047d66bf6bed8856aaa6763eba3cfb04ed3241f4c3dca92c217ac656aabd4b0a19923f691567c1c65cd8311df813d9ad5e5bfcd09afe8d894a3dd9aef1b51

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    3424ee4c72dd0c3ac57cc1e1a137b9e9

    SHA1

    690747d6d20fdae77720b034ba391c81ea37c798

    SHA256

    c9734f2b60d9a94294a2c9bcd3b1570e9f4b341ac08178de223646864833cb5b

    SHA512

    e89133931c85d7ffc1acb26e812867eaf365169663e5d4b7591f23c2bafa2c949abf186eb8db4a46b8b007c35ee999d2123e51e2f07cc83e0a1c446e437b0768

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    826KB

    MD5

    2a033f914ebbb0c8df9bb9effdf72f57

    SHA1

    2c488218f8cf04b73db42c854bc348c0a994de7a

    SHA256

    8539991f73b64de58635102b1b5fb2c0b740e867d3d9d62ebb711ab610c296fe

    SHA512

    9459e42417278f4ec66f18f880e20835d6f58a4655ef1d38c5b63746a3ae2333d14a7ba269f77fa608cfc597a711fb389e22943a2cbe3f92021f79c22e53d4d0

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    755KB

    MD5

    5b5f85db4882bc9b3a35fb423ff093b5

    SHA1

    985373c2fee7ed239ae558bc36a786b0c283a697

    SHA256

    2a89066f207c0618a441733b70cd6ec7ef572414e968952c17294f3afb15e901

    SHA512

    47efac657e39801f669c8558b3c89b188d2401de533c0aacac2aa008905c460b59fcbb9efcbbfe303cf5cb267df6510d83bc98db0955c4e2df623691bf7d1c45

  • memory/2000-318-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-278-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-11-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-368-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-232-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-358-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-348-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-336-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-328-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-244-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-13-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2000-308-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-246-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-298-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-256-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-288-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2000-268-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-243-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2044-287-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-263-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-297-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-255-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-307-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-245-0x0000000000350000-0x00000000003C7000-memory.dmp

    Filesize

    476KB

  • memory/2044-317-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-277-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-327-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-0-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-238-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2044-335-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-347-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-233-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-357-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-231-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-367-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2044-4-0x0000000000350000-0x00000000003C7000-memory.dmp

    Filesize

    476KB