Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 11:12

General

  • Target

    39ce4467889b32531f269f79ee0fe1b3_JaffaCakes118.exe

  • Size

    316KB

  • MD5

    39ce4467889b32531f269f79ee0fe1b3

  • SHA1

    661215fa11ff3cb84ba377c8b5b41591b5f49502

  • SHA256

    faa84d4d22161a929b0313fb4a08ca424dad87b6c536e1a71853879f6499cc76

  • SHA512

    2c7288ca7f50375be226f34c54f6f82654b5ed79a34fa715bb2d1a5d9119eb837f82a54253b3c03e5cd6b1952a5db12a5a730c4261017f15915bac053049c1ef

  • SSDEEP

    6144:FrybUzkuvcBYC47l2xphuK2+Otbaysqo+/VKitoTxwbs5iD3B2phoA:FrLkuveY3EMK9ObxD/06s5w3BLA

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39ce4467889b32531f269f79ee0fe1b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\39ce4467889b32531f269f79ee0fe1b3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\TsuBA8DF0B4.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{8B9C08B3-3DAF-4E3E-ACD5-758D507F2A45}\Custom.dll

    Filesize

    91KB

    MD5

    e6692b129ceb719afac35060c82a3f5b

    SHA1

    ae6add5ece16154b0954e675c45b4f9db964002b

    SHA256

    959d6a1a450279d35b253e104e9e5ea02d9eb996a3b8042cc31ee4891b571198

    SHA512

    1353b1324478322e216f559fdf35a90604764a600ab6c779e33c67622445d4b881a82bfb33454f783a4c3bb95c2f6a0c46e63c45290863d10e9bd6c2e98fe118

  • \Users\Admin\AppData\Local\Temp\{8B9C08B3-3DAF-4E3E-ACD5-758D507F2A45}\_Setup.dll

    Filesize

    173KB

    MD5

    a9f8248fbe4c08e7031641baf102f432

    SHA1

    f830f1c75f35abb352aaa67b3c15bf01bc2f3b2c

    SHA256

    9c760af153597853ca6c96e6ddf6674d8cefefa4b4daa3001ebf6399768cd2d8

    SHA512

    92c32c9ccfbd4fcf9c7d6f743a24deba733a7545871d6d6a436490ad0001e7f07cd8b926f858999d4d2c7e1adddeb93100c6cdbaeff4e8aaf9b50b3714c48992