Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 01:20

General

  • Target

    7f0f35c50f67a8a383dfca21d12780a2_JaffaCakes118.exe

  • Size

    564KB

  • MD5

    7f0f35c50f67a8a383dfca21d12780a2

  • SHA1

    5b8d4cbd1393b3bf156ed731102bb7f737dc632c

  • SHA256

    470153e2955821a4063f2645f5eea53551c28d2980cb2f34b236e4b14c0cd289

  • SHA512

    0f5d584e43e33de05a62aab7ee6c72dbb0eee1d82fb342fa569bf32d7aeb0c761c462835939d826e1b3dcb3ebe725be6480276a964d7aec5f49cb0b00521743b

  • SSDEEP

    6144:eIwsII3emtkVXCMbMgotROuV8U7gXCMb:dxveCMAlCU7GCM

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f0f35c50f67a8a383dfca21d12780a2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7f0f35c50f67a8a383dfca21d12780a2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nyxphbe0.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1353.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1352.tmp"
        3⤵
          PID:3004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES1353.tmp

      Filesize

      1KB

      MD5

      6e2b345ca04646ec1eb042c4e3ea7916

      SHA1

      a0b0a62b9bd1b30a13722cb634666c0db997fabe

      SHA256

      c2889443dac68ef742bfdc156d94e9df6cdfe761dce8a6d72b108995df802621

      SHA512

      d091178dc87c53dc75a2089cd0dced5c75706cc960439ee485c598991077da7d05ad703c446598697104cb8dab2587990b86f3c72e979a47ee14930bc813986c

    • C:\Users\Admin\AppData\Local\Temp\nyxphbe0.dll

      Filesize

      220KB

      MD5

      0e3fa252d0c0fd7da4946bfa21f19291

      SHA1

      c338d6e2c1814fd474870a89b410a26b14d08835

      SHA256

      aa123bf634ed1a7a3c2134493966264c31f004c628e2eb29deaee374eac48328

      SHA512

      defa687a4cd0c5f7a1a9254878da64d0a90efe008dc3ce653f9558a46c6d235fa9e27634d4628f192c377385676e11d73afdc49b6d373dbdc363fe955057c55c

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC1352.tmp

      Filesize

      652B

      MD5

      e3e213dc631576d13e72022593b6a3c3

      SHA1

      c2c48c7e37be44e018cde290383e76c9f48e6c01

      SHA256

      7c02fbc9171423e15cad99de83cdeb700f534ed041f073255b7c338e7858074c

      SHA512

      607b47852fe9d05ed5720fe0071bb9834681f4b71e0f59554b2ceb19f50e935fe75dc35446186d52a5c272dbbe9a66b4c80cd68ac183caea183a53972672d481

    • \??\c:\Users\Admin\AppData\Local\Temp\nyxphbe0.0.cs

      Filesize

      484KB

      MD5

      f810f2d788309d1a6e7808653dfb9bda

      SHA1

      3a3f99c446686ecfeb56ceeeab1b736ca2450f9b

      SHA256

      b79cf5e7a68bf23d0d7cf4856e08e4bea2ba481dac9694aacf9a7c45449dc457

      SHA512

      740ed8dadb01cf418f37004abf9404f3f76998ea114b51c492cefb84a827a09ba1e0a1e6d25d7deca689cd71e3d6855367d1e7511d42d3395f61b190975ef07d

    • \??\c:\Users\Admin\AppData\Local\Temp\nyxphbe0.cmdline

      Filesize

      707B

      MD5

      31c14cd8a87b7c5c4fc02ffc7c8b25b9

      SHA1

      5383e288477ed08fe9be2c8a55fa638bfbfb8cbb

      SHA256

      96384ef2e5a8e534ebfc833c575fc3f693e579d7877dd9cc70fac4ea706ec081

      SHA512

      998992745c2ca6af26e6d2152d5eefe3ed8a1fafbf77ec8a1ba10a22eb0802dd4d9b9652a43ae51dc117b8135d774e8ff922d276be145612efcbfd09db0e999d

    • memory/1408-18-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/1408-11-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-4-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-8-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-0-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

      Filesize

      4KB

    • memory/2368-3-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-2-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-20-0x0000000000480000-0x00000000004BA000-memory.dmp

      Filesize

      232KB

    • memory/2368-1-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-22-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

      Filesize

      4KB

    • memory/2368-23-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2368-24-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

      Filesize

      9.6MB