Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 05:45

General

  • Target

    8620da38e0e1f1c9817624b9560e09de_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    8620da38e0e1f1c9817624b9560e09de

  • SHA1

    88b09618974c7cf0e6e3e012fcabcdb21ea4b02b

  • SHA256

    91d2a2953480861b99f497cb0e1b2209445e6c939e979df59d69ffdedd656598

  • SHA512

    b09a11c9f6a7e860aa6749e2d720e6a5b40e3f56f7f2e07cdc5040a2c9c71e30cc01bbf16a16da2233e3b0dd903e633ac9b3682ec5d9516bcd94de4dcc9c83d4

  • SSDEEP

    24576:NmUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT58:NmV2ApemV2ApemV2Ap8

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8620da38e0e1f1c9817624b9560e09de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8620da38e0e1f1c9817624b9560e09de_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    65a9f512962e25d84e80d5d5326e9250

    SHA1

    c0e8e91c2648ea4c25e8a92a42594c3d997914fb

    SHA256

    74b5eb89dc3556ad2a5e047371726c356d8d3d75bbb28a06159d05ef13ae6bb7

    SHA512

    0e3660a0400d3740cdd08a0fbd0e8f1fd7fc0e0c45c5b8db30ada2650b8c247ed6a716191580ed5470108d759702696f4864f626101baff8fccb623f033f43b2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa7424a79bfa6e8d77ce5a1c9cf1f7f3

    SHA1

    b0d9f393caa9722ab413cb9e4ad3fad406ee5ab6

    SHA256

    c41cd31ccddfefbd83d55d97533f5af07dbf794bdd551e8ac6ec53a9786b3fda

    SHA512

    cf3beee1ead37f0bd90df62e27107adb944aefb411e952f53dac221f9d5559694e0bb9ca88a4f9643d55da93402b6ce032a0d86867557b2bc987f9c0c86f2381

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\login[2].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\4898.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\B192.tmp

    Filesize

    23KB

    MD5

    e99ffa6298cd2aaa7c50e2c8ec03a911

    SHA1

    07a9fd7d4a8abd688471b175ec7bfbfade89db01

    SHA256

    0224590556543ab165e8c363637626ebafec86b59ee41dbff45420073016d270

    SHA512

    68e85d225e0cfe498542f2cf66a2914832e25547c495dc7afc0286707548dbd05195fda3c09826c495212d6d71ed5220409e6111b2bdaf0b715a0bf6396f446f

  • C:\Users\Admin\AppData\Local\Temp\CabA01A.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\EE06.tmp

    Filesize

    1KB

    MD5

    f31c753aa2e4c91fac26edf866470cff

    SHA1

    0620100f2b27fc85675d05073aa928fc6fac8240

    SHA256

    9d8c0ae58839c45508350db86e3335b225aa4e0108687d3f04a863d316af399c

    SHA512

    c0d0a18c2f3f4f77d776276f1c94ef3a7db0429320c5dfae8bafd2681a6d03d21128560dad4ad336cc7bac8c83654c07d4f46e18e24547d8d51342f4c84acdc2

  • C:\Users\Admin\AppData\Local\Temp\TarA03C.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\TarA0FD.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\AppPatch\svchost.exe

    Filesize

    1.0MB

    MD5

    d82770007401f138ac4e763637036e34

    SHA1

    bbaa5f7b24a394fe190865725ad01efc5a53a50d

    SHA256

    0a70011013bd9db8a406a4d31b60a373726b2ba622065238454bf7726c78840a

    SHA512

    4045c41fb0353d40a522c432355309197b9750b47274b8c34052b7138dfffbcaad5f44e8ea1267086d22c6e970b878f75efcd2916fe4c81ff45de693275e6a20

  • memory/2180-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3048-62-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-54-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-27-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-31-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-37-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-46-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-59-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-78-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-77-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-76-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-75-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-74-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-73-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-72-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-71-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-70-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-69-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-68-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-67-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-66-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-65-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-63-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-23-0x00000000020F0000-0x0000000002198000-memory.dmp

    Filesize

    672KB

  • memory/3048-61-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-60-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-58-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-57-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-56-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-55-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-25-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-53-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-51-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-50-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-49-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-64-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-48-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-47-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-45-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-44-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-43-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-42-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-41-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-52-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-39-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-38-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-36-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-32-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-18-0x00000000020F0000-0x0000000002198000-memory.dmp

    Filesize

    672KB

  • memory/3048-20-0x00000000020F0000-0x0000000002198000-memory.dmp

    Filesize

    672KB

  • memory/3048-24-0x00000000020F0000-0x0000000002198000-memory.dmp

    Filesize

    672KB

  • memory/3048-16-0x00000000020F0000-0x0000000002198000-memory.dmp

    Filesize

    672KB

  • memory/3048-14-0x00000000020F0000-0x0000000002198000-memory.dmp

    Filesize

    672KB

  • memory/3048-35-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-34-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-40-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-33-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB

  • memory/3048-190-0x0000000002470000-0x0000000002526000-memory.dmp

    Filesize

    728KB