Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 21:15

General

  • Target

    a267b914101f369e45a543f833309699_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    a267b914101f369e45a543f833309699

  • SHA1

    a348e843d9f31b1e8da2dd37a14beec69689b90e

  • SHA256

    e9b2b2232c51bf0cd0e251132002e594bd2eb1fb92d10f8dd6dcddbb8eae3893

  • SHA512

    6ab67c151c1a99973878c9218dd42a5b2a5b0e30a0b5c359616816a7e54b25ebf96bbcff589f0162440d2c142c501b3d7562a662bde991409bec09a3a73d12b7

  • SSDEEP

    49152:9W3IDPx6lY6kWIaWu3neUZFQPWDvG96iv:9bMlY6kWfr3neUZOPWDo6iv

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a267b914101f369e45a543f833309699_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a267b914101f369e45a543f833309699_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    689d98e61514dd9c6b922fa320f6e942

    SHA1

    2c02bfced839c8b0727c50d40af187594f4f61af

    SHA256

    a5f71e6580ef56de3cd13ea55c7f8ab5524332975c88b85ee0712a63cf90b850

    SHA512

    274a0cc4d9630b8dc09e45b9b0f1ffb854b2f2cf84ffc71bdc22942fee1d070e6f6b63de6972aaef84d0dec6d0565f21aa34c1776e4d24a0cdc021ba4eec774a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    ca399af2920abe95f98ff50392ffb9c3

    SHA1

    48080af421ed6e2015172b4bc544359a5b4f6ddc

    SHA256

    1df54e0976f84153f2508eda6733b0903116d1af5beaf6bd13b49ff04df09b88

    SHA512

    95a14809ff8dde167ebdd634b7831fe60d86cd1b0e7c1f5c3d64c37b58dfecd62be7ef426b690d14e7e397c0f134f9a76dc9749e7db3c1f4b8cef6a363e517fb

  • C:\Users\Admin\AppData\Local\Temp\Tar11C1.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2392-146-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-1-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-145-0x00000000023A0000-0x000000000244A000-memory.dmp

    Filesize

    680KB

  • memory/2392-0-0x000007FEF534E000-0x000007FEF534F000-memory.dmp

    Filesize

    4KB

  • memory/2392-147-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-148-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-149-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-150-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-151-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB

  • memory/2392-152-0x000007FEF534E000-0x000007FEF534F000-memory.dmp

    Filesize

    4KB

  • memory/2392-153-0x000007FEF5090000-0x000007FEF5A2D000-memory.dmp

    Filesize

    9.6MB