Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 13:13

General

  • Target

    72122a87f158c073c0eb2d17e60487f7_JaffaCakes118.exe

  • Size

    586KB

  • MD5

    72122a87f158c073c0eb2d17e60487f7

  • SHA1

    0ac0e4f6a578494ada9557d31b7f9a3e64e4ab86

  • SHA256

    2c0c45a8ee4f73e24e4ef4d3a2d3f3fe288f7b3816f8aaf84507f7358abd2d82

  • SHA512

    89821ba530845dc1da50dfb3de86aa4f47804c2c82aff2276444d384d4e75d085b7ceb0357e097447f55b7259490986154b8443bdfcf194f33842111fccdbd6c

  • SSDEEP

    12288:AXznQ+bCxWrUhLZvzC/igEhrNA9SNwyrYAmyhIna3PiGpYh7jq:xgIh0/iLhrekeKYAl4RNq

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72122a87f158c073c0eb2d17e60487f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\72122a87f158c073c0eb2d17e60487f7_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Temp\72122a87f158c073c0eb2d17e60487f7_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\72122a87f158c073c0eb2d17e60487f7_JaffaCakes118.exe" Track="0001001000"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2192-21-0x00000000001C0000-0x00000000001C3000-memory.dmp

    Filesize

    12KB

  • memory/2192-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

    Filesize

    12KB

  • memory/2192-0-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2192-20-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2524-28-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-30-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-5-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-17-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-23-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-22-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2524-13-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-9-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-7-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-24-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-25-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-26-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-27-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-3-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-11-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-31-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-32-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-33-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-34-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-35-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-36-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-37-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-38-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-39-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-40-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-41-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-42-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-43-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-44-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-45-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB

  • memory/2524-46-0x0000000000400000-0x00000000004F8000-memory.dmp

    Filesize

    992KB