Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04/06/2024, 18:03

General

  • Target

    95c5f2eada7b45ab9bb4468bed70c098_JaffaCakes118.exe

  • Size

    789KB

  • MD5

    95c5f2eada7b45ab9bb4468bed70c098

  • SHA1

    93735fb46e3baa58a04ddcd33f11e93bbf84415f

  • SHA256

    50b6795cc245cce1196a8c79d21f3b8afaa7854d3eace5af75f0cc3dcd398c51

  • SHA512

    a64151924327985a24a2918bd1ee09a4518232c127b8178e603e34a30f897de6bf15dd3148a9962470c17f30a46030307f3c9884bf11da2689fd6c876d1164fc

  • SSDEEP

    12288:h9lkHYuY0pHAbHMyU2S/jvS1Ns2z0s9hfO5zffL/Na8Ddbrgta9zdJ5:hnaY/xs28jvS3F9hforjFa8D2E9zdJ5

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95c5f2eada7b45ab9bb4468bed70c098_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\95c5f2eada7b45ab9bb4468bed70c098_JaffaCakes118.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1660-2-0x0000000000AD0000-0x0000000000C55000-memory.dmp

    Filesize

    1.5MB

  • memory/1660-9-0x0000000000AD0000-0x0000000000C55000-memory.dmp

    Filesize

    1.5MB

  • memory/1660-11-0x0000000000AD0000-0x0000000000C55000-memory.dmp

    Filesize

    1.5MB

  • memory/1660-10-0x0000000000AD0000-0x0000000000C55000-memory.dmp

    Filesize

    1.5MB

  • memory/1660-12-0x0000000000110000-0x0000000000111000-memory.dmp

    Filesize

    4KB