Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 13:57

General

  • Target

    3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe

  • Size

    460KB

  • MD5

    3a75ad36745a128836896eb0ac1bea80

  • SHA1

    0b9c0364ae194f2cc75e05c29d26eed6e7fd9223

  • SHA256

    02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455

  • SHA512

    60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9

  • SSDEEP

    6144:Ab/2Sw+oJEdJGpT42yoW4RYMnlYnnzsEpPRvutJTtgWfOiMY3NewDyNYu:6kE/O4OW4SkYnnzlptuzhfOg3NRI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe
      "C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\parent.txt

    Filesize

    460KB

    MD5

    3a75ad36745a128836896eb0ac1bea80

    SHA1

    0b9c0364ae194f2cc75e05c29d26eed6e7fd9223

    SHA256

    02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455

    SHA512

    60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9

  • C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe

    Filesize

    7KB

    MD5

    e866084611bc2075e4f5e6f265144f20

    SHA1

    89e62a9c1ef200c5c35af37ec5169d6ee805a535

    SHA256

    a69c21088dd3cc1b86be21ff9784f9d87f083bd2317dc4c8b0b3982ee187250a

    SHA512

    c3ddbf564cfb30c977c59aa8f3e3f921e7d3cf1b934c35a22384f7eec45447cf37e25cbc12286fe26c5aed1cff856d65d08412cb5e2633c22b788fdeb9e57b86

  • memory/2164-14-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-11-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-12-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-13-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-10-0x0000000000A80000-0x0000000000AC4000-memory.dmp

    Filesize

    272KB

  • memory/2164-15-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-8-0x000007FEF5D6E000-0x000007FEF5D6F000-memory.dmp

    Filesize

    4KB

  • memory/2164-22-0x0000000021230000-0x00000000219D6000-memory.dmp

    Filesize

    7.6MB

  • memory/2164-27-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-28-0x000007FEF5D6E000-0x000007FEF5D6F000-memory.dmp

    Filesize

    4KB

  • memory/2164-29-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-30-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB

  • memory/2164-31-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

    Filesize

    9.6MB