Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/05/2024, 18:15

General

  • Target

    6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    6081277b1c6a1fcb478cd938298bd327

  • SHA1

    2581861ef703055895db434dfcab89746102ff7e

  • SHA256

    b57e589ef7ee2da883663527878128aa0c1909d0ba7a9bca91f10f04e91a47fb

  • SHA512

    7bf6299df2d0f6eed284c8959d582fa0ecaaea66fe403b78eebb5c077de95a262d40683b1129804cf55edf422dc01d199c65855aa273d5974ec8da174c599ba5

  • SSDEEP

    12288:MandmtR21mT1TUylJDvc8aYm59SDV5Sor8gZWkXaXyo+5DCG4OQRQNxHb4KDqapV:MW1uGy+SRQorc5ihDCIAK9/ICH

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk " /f
        3⤵
          PID:2872
      • C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6081277b1c6a1fcb478cd938298bd327_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2516
      • C:\Users\Admin\AppData\Roaming\FolderN\name.exe
        C:\Users\Admin\AppData\Roaming\FolderN\name.exe
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1688
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk " /f
            4⤵
              PID:632
          • C:\Users\Admin\AppData\Roaming\FolderN\name.exe
            "C:\Users\Admin\AppData\Roaming\FolderN\name.exe"
            3⤵
            • Executes dropped EXE
            PID:2424

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk

        Filesize

        832B

        MD5

        7b88f84d8ae88ccf1bbe24864ba6df4e

        SHA1

        0025eaae4115ea813213903e21e4530b564b4966

        SHA256

        eba95e20f2e0dfbf98a3b402cc828e24aefc41385dffcb4ee50ea0b470e6a4a5

        SHA512

        672a92a33a4196191065ef0394f0152eaf5878ca755ac2423e67ccb5269237f4a0e4ebc0dfe5d653f0a26039f997929913ef029750b2075a93ad9c7a99212e17

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk

        Filesize

        874B

        MD5

        a07c444c22b2656f31aebacbae854908

        SHA1

        ae04023bf53ae87cbf8d6e5501e7f21060bcf8be

        SHA256

        f23e89964fc4c44056f12faffd5452df0af7661abd80e60b89e33f809c76c719

        SHA512

        8929f9dfe9e603f6b9aefd2036a5e329d13dd9dd99ad22b5a234352036e43351a8eb7fdc92065127829e41f9dce80feea2a97ecce1cb96c0e3bc78d31b0a192f

      • C:\Users\Admin\AppData\Roaming\svhost.exe

        Filesize

        85KB

        MD5

        2e5f1cf69f92392f8829fc9c9263ae9b

        SHA1

        97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5

        SHA256

        51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b

        SHA512

        f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

      • \Users\Admin\AppData\Roaming\FolderN\name.exe

        Filesize

        1.4MB

        MD5

        6081277b1c6a1fcb478cd938298bd327

        SHA1

        2581861ef703055895db434dfcab89746102ff7e

        SHA256

        b57e589ef7ee2da883663527878128aa0c1909d0ba7a9bca91f10f04e91a47fb

        SHA512

        7bf6299df2d0f6eed284c8959d582fa0ecaaea66fe403b78eebb5c077de95a262d40683b1129804cf55edf422dc01d199c65855aa273d5974ec8da174c599ba5

      • memory/1640-0-0x0000000074371000-0x0000000074372000-memory.dmp

        Filesize

        4KB

      • memory/1640-2-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/1640-33-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/1640-1-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/1640-31-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/2424-52-0x0000000000080000-0x000000000015C000-memory.dmp

        Filesize

        880KB

      • memory/2424-48-0x0000000000080000-0x000000000015C000-memory.dmp

        Filesize

        880KB

      • memory/2424-55-0x0000000000080000-0x000000000015C000-memory.dmp

        Filesize

        880KB

      • memory/2424-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2516-18-0x0000000000400000-0x00000000004DC000-memory.dmp

        Filesize

        880KB

      • memory/2516-22-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/2516-23-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/2516-21-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB

      • memory/2516-10-0x0000000000400000-0x00000000004DC000-memory.dmp

        Filesize

        880KB

      • memory/2516-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2516-16-0x0000000000400000-0x00000000004DC000-memory.dmp

        Filesize

        880KB

      • memory/2516-20-0x0000000000400000-0x00000000004DC000-memory.dmp

        Filesize

        880KB

      • memory/2516-8-0x0000000000400000-0x00000000004DC000-memory.dmp

        Filesize

        880KB

      • memory/2516-6-0x0000000000400000-0x00000000004DC000-memory.dmp

        Filesize

        880KB

      • memory/2516-56-0x0000000074370000-0x000000007491B000-memory.dmp

        Filesize

        5.7MB