Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2024, 12:53

General

  • Target

    6752cb4f2b87c4a6612244a2603ab64f_JaffaCakes118.exe

  • Size

    714KB

  • MD5

    6752cb4f2b87c4a6612244a2603ab64f

  • SHA1

    ff3b1498714f27756cccf017318e74cdde7bf3d7

  • SHA256

    051d97d1f5d840b7c942ea453c5210571b2c27303a00ea1fa5f89f9eeb162e31

  • SHA512

    29bc98f7ab97c640bdc048ae9550b38292aacb81b834bcbd2b172efbc7f652977d33d750e0d4e102c089f60d5fc2f0e6ebb6385824303495a83519697edafb1f

  • SSDEEP

    12288:zlJl5dW7tns88GArl/stEnYEefkFnF0aAHX0ZKjFLGKYBtbfz3Izl9Mjfc8vy4hA:zjlTWpnb8JrlGEYfk0x37j/2bfz3Iz3t

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6752cb4f2b87c4a6612244a2603ab64f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6752cb4f2b87c4a6612244a2603ab64f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\bedgfeafca.exe
      C:\Users\Admin\AppData\Local\Temp\bedgfeafca.exe 7^4^5^9^3^6^4^1^6^9^1 KExEOzorNTIwKh8oT1A5TUNAPCoXLkdBT05MTEdIPjQwHi4rZ29pYHRda21aaWA0T19lbFteZBkrP0BQTkVDNyk2MC0tFyw9RUM3Jx8oTE1GQU8/U1lAQzYuMTAxLRwuTTxRT0FNVlJMSDxia3NpNiomcGxyLT48UkQpT0ZNJz1PSiVIR0JKFyw9SEg9Qkg9ORsmQSs5LCsXLj0uOCQuGitDLTQsKhwqOzE3KTAaJkMuOSgoHSlMUUk7VDxQWkdPQ1JAPVA8GStLSUw+UUJOVkROSDw0HSlMUUk7VDxQWkU+R0E8GiZEUUFaTE9GOR8pPFc+Wz5EQUZFTT80HyhESkpRWT5RSU5SPk44LB0pUEc7RUpSS1BWUkxIPBomVUY5LRcsPk8wNxcuS1FJS0ZHQV5RPEs8S0g8Rkc9Rj9MUUU5GyZGTVtRT0VTQklANHFscWQaJlE+UFBJS0NKRllMUj5OWjs+U088LBcuQUU/PFU3LR8pQFJYQFRFPkdFQlk8TTxOVEdRP0A8YFhrbGEbJkFJU01GRkA9W0RHOjEyLSwlNSctNCwdKUxATDhLRUFHVkZIT1M7Q0s2YlxjcF8cLk5ATD45LCswMDEzLyo2LxwqO0xRSktJOENYUEREQjczLisnLissLCwnLjYxLDE0LyZLRA==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716383136.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716383136.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716383136.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2348
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716383136.txt bios get version
        3⤵
          PID:1656
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81716383136.txt bios get version
          3⤵
            PID:2824
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2680

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81716383136.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\bedgfeafca.exe

        Filesize

        975KB

        MD5

        33c8a3becca901b784a5e2caf8e0dc4b

        SHA1

        6260dab54eafd394cce1a3a9f1f20611bed395b4

        SHA256

        4f53e616795b036f4d1e102c871ad9a81600c852fc496fc065fe2d35f7a56f2c

        SHA512

        f1e9ec27dd1df5ace990b6aff5d98757d2ada339ca5b2368d10df84b8ddd432eb0012327e64d6a2394b5ae7eab12871b1e4bb29345971171918123cb45f777f4

      • \Users\Admin\AppData\Local\Temp\nsd140E.tmp\ZipDLL.dll

        Filesize

        163KB

        MD5

        2dc35ddcabcb2b24919b9afae4ec3091

        SHA1

        9eeed33c3abc656353a7ebd1c66af38cccadd939

        SHA256

        6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

        SHA512

        0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

      • \Users\Admin\AppData\Local\Temp\nsd140E.tmp\hetpbrh.dll

        Filesize

        153KB

        MD5

        680d69caddb35d39626cda7f06ed8de3

        SHA1

        85b7a9af7658ae4adb4bacf4e087c4f53b0f32e6

        SHA256

        c6d54c99dff947e74d01be46905cd4ea5171f0e01300caea23fc08d41e52d54a

        SHA512

        09ce2e5d0e7794aba376493e005c0d7fe75b37ca5366cf52c235cf986161859e867124cf64f8867d27919d5e5277fdc8c365595e75a36aef7ad4026070c0a3bf