Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2024, 03:56

General

  • Target

    6d44111e1a27a1df71ce130ca5ba1b06_JaffaCakes118.exe

  • Size

    344KB

  • MD5

    6d44111e1a27a1df71ce130ca5ba1b06

  • SHA1

    a883dcfde4b03e95b0a22d94281dacf1b7b70b6b

  • SHA256

    4492d65192418541908be2b47759cae6bbfce2f82f9e41bf81eac60d1d3d1bf1

  • SHA512

    852d74b95937c8504fb676bec75460dc9977507f4d0037a9b37db730ce99b3cefdf8cea364c4724501aa5884ea6ee33e3d6f977e16759c21eb965f4d1cd7dc84

  • SSDEEP

    6144:+FJ0VZAu2ac57uGivAA0GcAlef4kMIauVJRHB3eMgJTlo:3ZAuDo7uGivPCRxaGHBuBTC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d44111e1a27a1df71ce130ca5ba1b06_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6d44111e1a27a1df71ce130ca5ba1b06_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\beehebjghc.exe
      C:\Users\Admin\AppData\Local\Temp\beehebjghc.exe 9!0!2!2!9!5!9!8!0!2!4 JlBHQjQxKjAgLU9MQk5HOzgnGC9MQUtXTVBCRDs1MR4rO0lRUkA/NC00MhwmQ0dCNCsXJ1BQSztVQVJWRDs1NDQtFy9RQ0lRPEpfU05DPWZya2sxJy9xbm0uQkNKRiRMT04pOFBOLEBJPUcgLT9DSUFJQD80GC9CLTQ0NjUsMysqIC1AKT0wMCsuFydEMTkkMR4tOy80JTEeKzs1OysoGyZIUk1ATENSXUdNQE5BQVU0IC1OSUo7TUNSWzxVSj80GyZIUk1ATENSXUU8RD09RGtpZXYjKStKbHJfcFxndyMpKzltaWpgXHIjMCdLaWdmY29qIC1DT0BWTVJKORcvQ1Y8WjpFREpFRUU7HiZDRktUXT5JT1VRPE00LSAtUD9BTElQSkxXVVBINCAtVEQ4KRgvQk8oPR4tSVBFTElLQVZXQ0o6SkQ9SUs9PkVTUEM4FydJUVtJVUxSQEg8NXRwcVwgLVA8T0xKTkdKPl9TUTxNVjxBV080Mh4tP0Q7PVg7LRcvR1FWP1BGQUtFOl9DTDpNUEhUQ0A0Zl9qamAXJ0RNU0VMTT87WkBIPTAsLy4vLycpMCsuLy4pIC1OOE04RExDSFZJTFFLPENEPXJubGUeLUtERD09LzArNzIwLzIqMCAtQEZXTEpGPDtXVEdJPD0vLyYsKicyLi0sKjE4Ki0xKTgoTEQ=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716523016.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1756
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716523016.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2560
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716523016.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2688
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716523016.txt bios get version
        3⤵
          PID:2564
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81716523016.txt bios get version
          3⤵
            PID:2464
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2700

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81716523016.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • C:\Users\Admin\AppData\Local\Temp\beehebjghc.exe

        Filesize

        563KB

        MD5

        65f7a0239113c91ffb312569e0627b08

        SHA1

        4877b661e6fbd5dd96afdf59e0c88cf44d64bf94

        SHA256

        c6da1362f1ae653ded8a65fed7d8b36b73b9e41c1ce01cbb087135053f5b2647

        SHA512

        0eba272c8ccc46ff51509ed642c4794d6d03c782f50482a29c950fa66666950c32d7468959d570e662005b962bc19b355c807754629ae9b5516f24d7748fbfda