Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 04:30

General

  • Target

    a3d28bbd0b2f5f2347f7113713655a36_JaffaCakes118.exe

  • Size

    296KB

  • MD5

    a3d28bbd0b2f5f2347f7113713655a36

  • SHA1

    95b01da3e88c7431ef90d8dae712f499ce4bf349

  • SHA256

    8e2aa6984e3a2000d4bbb71717233a8160f526b22eff47c950e148e567f360ed

  • SHA512

    48f59d844d2ca3c86f19ed14679a44f911d49478cdf0587d43d805c4e5e03ffa5429a8c9b1ab2c160104e02a5471ef8edc26f713229b1bf455b48a2742d507be

  • SSDEEP

    6144:Y0bxAZut+anmcqHuk2gGaK46ynMqyzdwoiUN1SpQM:tNAZ18mVOk2AQJN0Z

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1036
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1064
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1116
          • C:\Users\Admin\AppData\Local\Temp\a3d28bbd0b2f5f2347f7113713655a36_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\a3d28bbd0b2f5f2347f7113713655a36_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1008
            • C:\Users\Admin\AppData\Roaming\Ipbahy\zyov.exe
              "C:\Users\Admin\AppData\Roaming\Ipbahy\zyov.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1444
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\VUP2799.bat"
              3⤵
              • Deletes itself
              PID:2484

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\VUP2799.bat

          Filesize

          267B

          MD5

          ea03e3af3cd85e601242c1fa7a57eb17

          SHA1

          973c77f82b44116de152e4134dbe8e1f3ac3706c

          SHA256

          ff6ad21b96d4f38fe09ff0c23ac54590d956e5be9db2df88cd40767b66d957f8

          SHA512

          121bf2fb7e6b56864c29ff149f8cc12440e3899b6abd596ea6ee98b2f6679ec38fd4c2ee6594c38ca76421d0cdf69257091d3509f93184fe4b75eac338ab6b5d

        • \Users\Admin\AppData\Roaming\Ipbahy\zyov.exe

          Filesize

          296KB

          MD5

          0cad14653c713f1aa305a48097a146d9

          SHA1

          9c75d1675fd6beacf1c449b909680d5278b94191

          SHA256

          a0ee91feaaccfe8f6695b7212072b4c2f6b3737d73c04c783479618bb87a0d35

          SHA512

          b1ec36fd1749bf53210addbc7f44a8c8706412f00d781d14109f73dea55cbe4d925295048127fd9e6c4069aed3bc2c1e4a3e692a53b83b4debb895eca868ef6a

        • memory/1008-51-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1008-55-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-65-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1008-54-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-14-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1008-44-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-43-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-49-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1008-50-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1008-52-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1008-2-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1008-53-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1008-1-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1008-48-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1008-47-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-46-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-45-0x0000000000550000-0x0000000000598000-memory.dmp

          Filesize

          288KB

        • memory/1008-0-0x0000000000405000-0x0000000000406000-memory.dmp

          Filesize

          4KB

        • memory/1036-21-0x00000000022B0000-0x00000000022F8000-memory.dmp

          Filesize

          288KB

        • memory/1036-23-0x00000000022B0000-0x00000000022F8000-memory.dmp

          Filesize

          288KB

        • memory/1036-25-0x00000000022B0000-0x00000000022F8000-memory.dmp

          Filesize

          288KB

        • memory/1036-19-0x00000000022B0000-0x00000000022F8000-memory.dmp

          Filesize

          288KB

        • memory/1036-17-0x00000000022B0000-0x00000000022F8000-memory.dmp

          Filesize

          288KB

        • memory/1064-33-0x00000000020E0000-0x0000000002128000-memory.dmp

          Filesize

          288KB

        • memory/1064-31-0x00000000020E0000-0x0000000002128000-memory.dmp

          Filesize

          288KB

        • memory/1064-29-0x00000000020E0000-0x0000000002128000-memory.dmp

          Filesize

          288KB

        • memory/1064-35-0x00000000020E0000-0x0000000002128000-memory.dmp

          Filesize

          288KB

        • memory/1116-41-0x0000000002ED0000-0x0000000002F18000-memory.dmp

          Filesize

          288KB

        • memory/1116-40-0x0000000002ED0000-0x0000000002F18000-memory.dmp

          Filesize

          288KB

        • memory/1116-39-0x0000000002ED0000-0x0000000002F18000-memory.dmp

          Filesize

          288KB

        • memory/1116-38-0x0000000002ED0000-0x0000000002F18000-memory.dmp

          Filesize

          288KB

        • memory/1444-82-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-83-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-81-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-80-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-79-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-12-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-84-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-16-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-15-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/1444-85-0x0000000000400000-0x0000000000451000-memory.dmp

          Filesize

          324KB

        • memory/2484-75-0x0000000077140000-0x0000000077141000-memory.dmp

          Filesize

          4KB

        • memory/2484-63-0x0000000000050000-0x0000000000098000-memory.dmp

          Filesize

          288KB

        • memory/2484-66-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-62-0x0000000000050000-0x0000000000098000-memory.dmp

          Filesize

          288KB

        • memory/2484-77-0x0000000000050000-0x0000000000098000-memory.dmp

          Filesize

          288KB

        • memory/2484-67-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-68-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-70-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-71-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-72-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-73-0x0000000000050000-0x0000000000098000-memory.dmp

          Filesize

          288KB

        • memory/2484-59-0x0000000000050000-0x0000000000098000-memory.dmp

          Filesize

          288KB

        • memory/2484-69-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2484-61-0x0000000000050000-0x0000000000098000-memory.dmp

          Filesize

          288KB