Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 09:37

General

  • Target

    804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe

  • Size

    233KB

  • MD5

    804a1f003f4942d4c81c6d221ef10e8f

  • SHA1

    3c91d9723ece75f2c98782739ce0fb3c6f60dbda

  • SHA256

    8613cef95caf6fce398e47856b320392b5fc0e940c891a3cc512562f29361b8a

  • SHA512

    3d1256063708aa91c59b730ecdcd8ad6b3270e49a8808d4d216aaca0e8cffc70e8814965de284e341e2af51d13b29b900614fdcd1de658bae5b90fcf057f5634

  • SSDEEP

    6144:4xyMeM8tKmy/q7RglyFlqsGnK48uGSiU4pt6:4xyMehti/8R7lJEGSiU4C

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\804a1f003f4942d4c81c6d221ef10e8f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\e9adc898-e100-48db-9c9c-ce2d4cff9ceb\start.hta
      2⤵
      • Modifies Internet Explorer settings
      PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e9adc898-e100-48db-9c9c-ce2d4cff9ceb\loader.gif

    Filesize

    1KB

    MD5

    e88ebd85dd56110ac6ea93fe0922988e

    SHA1

    684a31d864d33ff736234c41ac4e8d2c7f90d5ae

    SHA256

    379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

    SHA512

    211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

  • C:\Users\Admin\AppData\Local\Temp\e9adc898-e100-48db-9c9c-ce2d4cff9ceb\start.hta

    Filesize

    1KB

    MD5

    1e0053dfeeecf4c16284d6dad4fd86f4

    SHA1

    fe4ca30de707e1f77e5e258f62007f82633b6773

    SHA256

    e2d32f98e234880b02f55506b75e13ec992ed53f39c35c19bef070b081eea3bb

    SHA512

    5fb547735e5516f95ecb68bc5f862c7af963fe415a3aee9f2e4671473d1dbe36c65e2e2760900b96a81f5d27cb49b6f68c2f10d310ede93963ad78eea691e76b

  • \Users\Admin\AppData\Local\Temp\e9adc898-e100-48db-9c9c-ce2d4cff9ceb\helper.dll

    Filesize

    122KB

    MD5

    47cb6d4a317540d0fbbdbf813bd24d7f

    SHA1

    fdf0ca931b67bda1c62c157357dfb0729b9e9ee8

    SHA256

    d376d8192ece1fe69a9ec5a77fb512c41a3fe55417478635d7fe2d874e0ed49e

    SHA512

    1fb63ab4d7fb8fcc26f4c9333bbfa893b1253606035df6be8bfa2188e363372999f517bf63f061fa96047c5529a4170fc55c1f67828ae87c8a47b4b2362a1f80