Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 09:09

General

  • Target

    adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe

  • Size

    454KB

  • MD5

    adb0f8767bea7ac9d205e62186430607

  • SHA1

    0348576acf0c5b280cc201c6458157ae16d41307

  • SHA256

    5022d40ad46ed72094cdc31662452b47e26a4f19edcc290cff448d3546de5d41

  • SHA512

    97d7b2069ee89504dd31b8cc556d7f2c87b6cce1834beaac52949c2063259d9880e2e0e228127cbe241a09e0f2b266a3c68345038b395b22c16a8c131d14cd9e

  • SSDEEP

    6144:vvaqS4IR/kviXzd4N6qJFldlibYOlU/glqmOgDVL5ul94BhunZQpLzms7VFPYYK:y/kviXzdyGYr/eDVL5ul2unZatC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\adb0f8767bea7ac9d205e62186430607_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe
      "C:\Users\Admin\AppData\Local\Temp\\qfjesjluewfgfyu.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\parent.txt

    Filesize

    454KB

    MD5

    adb0f8767bea7ac9d205e62186430607

    SHA1

    0348576acf0c5b280cc201c6458157ae16d41307

    SHA256

    5022d40ad46ed72094cdc31662452b47e26a4f19edcc290cff448d3546de5d41

    SHA512

    97d7b2069ee89504dd31b8cc556d7f2c87b6cce1834beaac52949c2063259d9880e2e0e228127cbe241a09e0f2b266a3c68345038b395b22c16a8c131d14cd9e

  • \Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe

    Filesize

    11KB

    MD5

    9a7e17351f0e74570b387600922e59e0

    SHA1

    017bf40ae2cb8321ee9825e3b93339fd41a148da

    SHA256

    44b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c

    SHA512

    bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3

  • memory/1388-10-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-5-0x0000000000C10000-0x0000000000C54000-memory.dmp

    Filesize

    272KB

  • memory/1388-8-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-9-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-4-0x000007FEF5B0E000-0x000007FEF5B0F000-memory.dmp

    Filesize

    4KB

  • memory/1388-11-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-13-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-12-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-16-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-17-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-18-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-19-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

    Filesize

    9.6MB

  • memory/1388-28-0x0000000021D80000-0x0000000022526000-memory.dmp

    Filesize

    7.6MB