Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 17:50

General

  • Target

    79faa2b05473f0f795ef3797ecd1b698_JaffaCakes118.exe

  • Size

    581KB

  • MD5

    79faa2b05473f0f795ef3797ecd1b698

  • SHA1

    4316a720955cb0fd231967ac26ac1b34f3b8da80

  • SHA256

    14e40774ec3d78c1d59a9e9ce215a1577055b08b318d67e0b0117379fb3b2736

  • SHA512

    8172f9c7e01b24ad0a589d50f3d106fb8a935c86cd5010e2d33a13a68c3245f38a4e7fcec6eb87862eefa79196a93ab15e03f1e325f38a53d951613faebd6dee

  • SSDEEP

    12288:8LDJhNH8ZkXWykEr8369tNFMP8NdHXpZ2achJC4+M:8XJbl+36tKPdhJ7X

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79faa2b05473f0f795ef3797ecd1b698_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\79faa2b05473f0f795ef3797ecd1b698_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\1431831751.exe
      C:\Users\Admin\AppData\Local\Temp\1431831751.exe 3]3]2]3]7]9]1]9]5]8]0 LE1HQTYqLyktGC9QUkBNQjs8JxsnTkJRVUxLQkg7OCggLEFHUE1AQzQtLzI0Lx4sPEBDNCsYL01PTUFOOlNWRDw9LjM3MRkmUjxNTkVPXFNPRTRna29oOiwscW9vJUM8TkMtUUxOKjpHTyVERkZMHS1ARUBCQkQ8PXRIUUdMRDMsRCgwNkJJNkQ+QztQRjhDMx4sPSg8KCwoMDIdLUErNCwoGydEMDorLhkmQys4JTEdLEIyNiQwFypIUkxBU0BNVk9JRE5BQFY7HShHUUY/TUNRXENSRTg8FypIUkxBU0BNVk04SD09HSxDVT5WVElHNSAsQlZCWDpMO0dBTkI6HixBRlJLWjpSTFRRQks0LxcqTEg+S0lWSExeTE1EPR0sVEo2KR8mP0sxOh0tT05FU0BIPV9UQkpASEREQEg5R0JSUEk2Fy5ATldSUktSRkY8PGttbWUdLFBCTUxRRURGR1xSUUJLVkM4VEs9Lx0tRUI7RE84KSAsRlFcPVBNOEhBQ1xCTEBLUE9LQDw9Y15qcF4XLjtKT05JTD9BWEBPNDEuLi4tMCsxJTAqLhgvUUZLQjYoMyosMDMzNi4xGSZDRlJGTEw+QlxNQEw8OC0vLjQtLykoNCEvMjI1NzAxIzhMFypNQTpKbXdiY2tYICpmMisuKCFOaGVfZ3dwKExRJC0tKCArYihRcGZdXG1rICpmNCsuIixZKmlxHTNeLi8rKSAqY2RjZShEY2BkZh8mUEpMOmVycWkcMlggKmYiL2RkXmswJSspMS5hY3BiXm0lZGZmbCIwY0tsbUtkZWVBbHVrZWZgW0hZbl5kY29YW2RnZ2d5Ii9kLi0qMC8uLjktMyMvX1tubmlkb15ha15nWGZcbR0yYy4yMCovMi00KDYiMGQ2KTA0LTEwNC82N1VmTXFKZT11Sy91NERgYmdIYDFjS3d0b0NpTGtAV0o2SUE+cUtfMGlPdmBiVHM8L0M+a3FIQUNoUHBqJ0dLZ2VVZy0qQlIvX095cDZIQHBeV2ArLUt2ZGJVUGNpUEJgYldUQzRaY3dpX09jZVVVV2FPMWNiT3pPME9oLjxTTFBvTS0+bEdzYjdJZUZGTS1AQE08VG1NYTBlVi8uZ1hpams=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716832219.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716832219.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716832219.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2400
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716832219.txt bios get version
        3⤵
          PID:2520
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81716832219.txt bios get version
          3⤵
            PID:2036
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2776

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81716832219.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\1431831751.exe

        Filesize

        788KB

        MD5

        8890fe58240790af20b7006c537a69a2

        SHA1

        aebb9a5cbd652634e017bbe57d1ba032b90f5a5b

        SHA256

        747baf72bd89b1dc09ec74093aad6249b2ee983e56cb730476a107ee5024be27

        SHA512

        ddf24bf4004148b7f90b4659bc2cd59cc97c3fa9b1c75d2bfdb89d0547ecb1b62405d5258f6ea7c4e18c3892cb1cb7c4fb354f34a091325ca9b940d99eafb074

      • \Users\Admin\AppData\Local\Temp\nsy117F.tmp\cgibuti.dll

        Filesize

        153KB

        MD5

        9b081b4f84974a46cffcf1ef1a2e85f9

        SHA1

        70a1b83bad19d28195f2df22c3d213a04b42fb2b

        SHA256

        303f74df9812b639b66f919804039d1e295ffae8e543fa4349507110ac766752

        SHA512

        4539a458b1d2ba61ffcf71ea59addd13727d26606f73dbfb21053d68d5656010dae5791d486789c14653c6fb953a7dc284c3a80db2b1970a0e7f0778ab77dbbf

      • \Users\Admin\AppData\Local\Temp\nsy117F.tmp\nsisunz.dll

        Filesize

        40KB

        MD5

        5f13dbc378792f23e598079fc1e4422b

        SHA1

        5813c05802f15930aa860b8363af2b58426c8adf

        SHA256

        6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

        SHA512

        9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5