Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 11:15

General

  • Target

    919520086be7bf67867f290986967fa8_JaffaCakes118.exe

  • Size

    339KB

  • MD5

    919520086be7bf67867f290986967fa8

  • SHA1

    ed522e0fee145a0b68398c01d5cd380928db1844

  • SHA256

    66da37cbf884d5ec3f023f5b1b37faf3bd3a8cba5f7c9e3ef773a11b6f2a1e49

  • SHA512

    2cebfd7eab3a199498c8d8d0e3867a9f8a181dc1431d41a634c0089772131e9eae5688c49fb6f4f143b2eaf06a3043a1e1b417b2d2abaee27e85b1531220ab83

  • SSDEEP

    6144:+FJ0RntHbhiRh7Sm12P1pPWxHsvlP++6H4xcRvwiaT2phmQwNmGkgF:jntG7Sm0PW8oH4qX3phmVmG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\919520086be7bf67867f290986967fa8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\919520086be7bf67867f290986967fa8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\beeiibcjea.exe
      C:\Users\Admin\AppData\Local\Temp\beeiibcjea.exe 3!0!2!5!9!8!2!9!9!7!7 LFBHPzQpNy8rKxksU1M9R0FCNCcZKEtFUlJGSklAOzYqHS9CREpMRzs0Ky8uNi8bJjtHOzQpGSxQUEo7TUFLVkI9OjIzLisvHiZKPktTRVBaTEpKNF9tbW06LSpqanQlOz5MSC1SSkclP0dHJ0JLRk0bJjtKQDpEQkE9Hio7KTskKBkoQTI7KCgYLTsqNiYuIC0/KzUrKBcoPTI9KywXJ05JRj1OQFRdS0lBVDg6UjYdL05NRjxTOktYPlJMPzgXJ05JRj1OQFRdSThFQzQ4T0xTaWJgZj1iYGtoazQuLikoJjAsLz9uaWwjLSdIX2taYRksRVZAVk1QQzRhbXFwOComWmNqay1pYC5hamQncVxrbmkrZXZgFydDTzxYPEpESkRFPTsXJkFIUFRdPUlHVUo8SzYyIC1PPzlMQlBITlxVUEc0GC1NRDYrHS9CTig1HiZJTkdRSUtAVk9DQzpIRkJJSzw+PVNJQzYZLElRWklNTEtARj46dHBwXBgtSTxNTk9OR0k+V1NKPEtYQUFXTjQqHiY/Qj1CWDssFydHSlY9UktBS0Q6V0NFOktSTVRDPzReX2NqXhksRE1SRURNODtYQk09MCsvJi8oJycyMC4vLSkYLUc4SzpJTENHVkFMSks6RUk9cm1sXR4mS0JGQj0vLyswNikrKy0wIC0/Rk9MQ0Y6PVxUR0g8NS8oJisyLDIuLCwiNTEoKTMxMyhLRA==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717413341.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2600
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717413341.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3048
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717413341.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2668
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717413341.txt bios get version
        3⤵
          PID:2720
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81717413341.txt bios get version
          3⤵
            PID:2636
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2812

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81717413341.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\beeiibcjea.exe

        Filesize

        538KB

        MD5

        54fa8dd2d61c6dd39fe304e26620d36d

        SHA1

        177332ee322db4f3c41cbc93d2f77ce9c5657267

        SHA256

        dccc0c35c9c633afe40c4e2db6b2b55cb836887e2d48540f835b4a0bb9ed7b6e

        SHA512

        fbea379fbb25dbc740668883200eb5857538d20b08ed38af09a05f8b8f985a41ef1da1dfb1ac8cdc5c456457390624118fd121c5b65c85a3728fff6a94f99923