Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
7cd7e1be96600eda549254f46037596f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7cd7e1be96600eda549254f46037596f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$_3_.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$_3_.exe
Resource
win10v2004-20240508-en
General
-
Target
$_3_.exe
-
Size
1.8MB
-
MD5
77bfacca17ee1d89833b57f3a746d9a0
-
SHA1
aa9490c913489c5eafd02f67f875efcb56d23036
-
SHA256
38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52
-
SHA512
21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f
-
SSDEEP
49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 984 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2304 $_3_.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2304 $_3_.exe 2304 $_3_.exe 2304 $_3_.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2020 2304 $_3_.exe 30 PID 2304 wrote to memory of 2020 2304 $_3_.exe 30 PID 2304 wrote to memory of 2020 2304 $_3_.exe 30 PID 2304 wrote to memory of 2020 2304 $_3_.exe 30 PID 2020 wrote to memory of 984 2020 cmd.exe 32 PID 2020 wrote to memory of 984 2020 cmd.exe 32 PID 2020 wrote to memory of 984 2020 cmd.exe 32 PID 2020 wrote to memory of 984 2020 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_3_.exe"C:\Users\Admin\AppData\Local\Temp\$_3_.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3822.bat" "C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\""2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214B
MD5739fcc7ba42b209fe44bea47e7a8c48f
SHA1bc7a448a7c018133edcf012bc94301623eb42c5b
SHA25669017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c
SHA5122b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a
-
C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\BE9772138E464D02B9612D0875D42C71_LogFile.txt
Filesize9KB
MD50fb3111e9310017adb5ff83b155a947d
SHA1630586ceedfdf46a224e81d59a87721d69fafab6
SHA256b23e58256de638887c25d48d8da248ddea5986ee22be2fdb59bc8e6448ecf69b
SHA512857ff8f6f7f376084c78e3e0d0fa776f847998f6a7eece8965ba190c53e1d960db53c38b2c30cff04b869a4a5270764e59f94dfe7acbd5cc81107ce687ac7344
-
Filesize
110KB
MD5e6d99c69f61773b8e861941d7ead58f0
SHA18854806d070b8889fb2f5877441c4ceeeb863a6c
SHA256223f574cf7dd38b0b77a7bac8a54007547635bcc823e555d5463af339ca47217
SHA512704ddacec5c6147d7983ee4c49b1e8e155bcf6a7e19e0122e3e1738815ef0a3d62e4b059b350bb00c466ece277168e999d11c57db22ba1edfce82167139f714e