Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 12:35

General

  • Target

    8e17f2eae1da5385ce50ad181179cef8_JaffaCakes118.exe

  • Size

    489KB

  • MD5

    8e17f2eae1da5385ce50ad181179cef8

  • SHA1

    fbcadb9658b2b05c2b12682146af494a7fffefe0

  • SHA256

    7e8bed4d13a1ac272b9789b44eb307430edab0bf0740d8e46c9105a459f4f429

  • SHA512

    ed7d537556c552df80224c40ef512a43ef7334349b365c4fff2753d1ed9a4198f445ef70675e044b0a63ece0d57fa9ac1d26b0d8eda819f99cd0ad08ecbb9433

  • SSDEEP

    12288:lOQfhJ7kNO9EoUOPKD3ypHaWIjsDEDsj:lHJ7kY9EoUpDipjED

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e17f2eae1da5385ce50ad181179cef8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e17f2eae1da5385ce50ad181179cef8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe
      C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe 0\5\0\8\6\9\2\0\3\6\1 L0tJPDcoNzgxLB8vTlU6SkBCPS0aLk5AVE9JSUlJQTcwICpEQU1LR0Q6LDg2LzQYKTpHRDoqHy9LUkc+TEFUXENDPS04MDMvHi9QP1FWQFJXT0lKPWVuc3A1LydtaXQuQT9SSyhUR0okP1BNKEhOQU8YKTpKSUBFSEQ4ICc+KDstLhouRC09JSsXLUQwNywxGy88LjQrMR0pQzU4LSkaJk5STD5UQ09fSExAVEFAUzwgKlBKSTtTQ1FZRFVHQTUaJk5STD5UQ09fRjtEQz1icmQgKkVQP1ZTUkk3Hy9AWD1ZOktESUNNRTggJ0JGUVRcPFFPUlM9TDQzICxOR0FJS1FJTF1VT0Y8ICpWRTcpHi9BTTA9Gy9KT0VSSUo/XldATDtJRENJSjtGRVBSRDcXLUlQWVFVSVRBRzw7dG9vZCAqUj1OTFBORkhGX1BTPUxWQkFWTTwyGy9AQztDWDorHy9EU1c+UExBSkNCX0BOO0xQTlRCPjxmXGxrXxctRExRTUxKQTxZQE49Lyo3LiwxKCgwMS4uLDEgKlA5TDhKTEJGXklJU0w7Q0o9cWx0ZRsvTENEQz0uLjQwLzMtKy4zICw+TldJTEc7O11URkdEPSwyJysvLTItKzQqLDAyLTA4MzIkQE0=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717331752.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2608
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717331752.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717331752.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717331752.txt bios get version
        3⤵
          PID:2636
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81717331752.txt bios get version
          3⤵
            PID:2484

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81717331752.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\befadegfdg_P.exe

        Filesize

        674KB

        MD5

        93c3c1d0d5299bb9cefe9e9181a17070

        SHA1

        77a89de10714fd3862276d65ca4cb440628d81a4

        SHA256

        fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7

        SHA512

        9e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3

      • memory/2140-8-0x00000000774E1000-0x00000000774E2000-memory.dmp

        Filesize

        4KB

      • memory/2140-9-0x00000000774D0000-0x00000000775E0000-memory.dmp

        Filesize

        1.1MB

      • memory/2140-16-0x00000000001D0000-0x0000000000273000-memory.dmp

        Filesize

        652KB

      • memory/2140-18-0x00000000774D0000-0x00000000775E0000-memory.dmp

        Filesize

        1.1MB