Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    17/06/2024, 02:48

General

  • Target

    b66f8a1ee9519142c0ca99af7434dcee_JaffaCakes118.exe

  • Size

    339KB

  • MD5

    b66f8a1ee9519142c0ca99af7434dcee

  • SHA1

    113bc6d20a5987dab210104733317dbf74e0f150

  • SHA256

    2b4d13e2797e476d2b585feb3df85d713f32535267820a568ddaa2eb23e4cc66

  • SHA512

    4a9ad0c9d2cfdb914af33f0cb02b8e945947fd4c37c079063e884e00fcb35a1d0eca5315d86113729f48c67daae19e0254ef735b06d80b6934d1f97edca94f4f

  • SSDEEP

    6144:PFJ0d38nYZCRCFVKtP6c/TFY1ltb4uyy7NIT:a3f5LWH2NW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b66f8a1ee9519142c0ca99af7434dcee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b66f8a1ee9519142c0ca99af7434dcee_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\beeigeabea.exe
      C:\Users\Admin\AppData\Local\Temp\beeigeabea.exe 4*6*2*8*4*8*4*7*4*5*9 K0pHPDkqLywuMhcrTVM6TEFANiwbJko/Uk9LSkdCQDgoHClCQU9MRT05LTAzMC4YKztFPTkrFytKUEdATT9NW0Q7OSw3KCwoHChPQElSP1BXUUpINmRva2w0LSdvanInQEBKRydSR0wlPUlMKUBKQE0YKztIQj9GQEA3SC50MC9AMU5QRV0uXW5LVVNtYWBtT2RnTlo9XT1UO1ZbUEZzWkFzPi9fLEpdYFNgSF0uPkdGPStgRWFvUHJJR2xcWHJHLlZgP0A6PiswcjIqS1BFXlBkX0NpPTlhYnZPZGA9c2FgSlFndT9ORV5tcElEcU0cKjstNyspHCdAKzkoKBwpQis5JS0ZKz8rOScvGCs8MTYpLBcrSlBHQE0/TVtLSUVQPztVNRwoTE1GQE9BTFs9UUU9OBcrSlBHQE0/TVtJOEk/O2NfYGFsbyhcaGNyXRwnQVFBWkxORjscd01ORXkbJkFSQ1c/RUBFRUk8ORotQEtLUFg+TUZTTUNKOS0cKFBDOEpFV0dRV1FLSDhfcG5uMisnXVxoZFpnKF9cZGdfKippXHApcm1LbzRFMj5CdXRtTUxPTy9kamU1Zz1scDUuH3JcaS03JG5dai42InFYbi07KjIpMR9MPktUNyRlOWNfYWFuailfamFwXRwoUkg0LhotPE8pOSsyLCwcKVBNSkxFRkFaTkFGQUdJPUVGPUI8UUxKNRwnRUxbTUxKTkdFQTVwa3FgFytMQ0xRSkpCSkJWUU1DSls8PVJPOCkcKUZBQD1UNi0bJkVNXTxVRj1GRT5WQUhBSlVIUD5AOF1dZnFdHCdASFNJQ0s7QldFSDkrLDMlLSsuJjUrKiouLRcrSj9KPURIPkhaQEpNUjlIRDltbnBcHClSQUk9OSowLy8yLy8tMywcKEBKTkpGTTlAV1BCSUA0LSstKjMnLiktMCEzNC8qNi0wI0xI
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81718592533.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81718592533.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81718592533.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2220
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81718592533.txt bios get version
        3⤵
          PID:2748
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81718592533.txt bios get version
          3⤵
            PID:2636
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:1868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81718592533.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\beeigeabea.exe

        Filesize

        538KB

        MD5

        f5a8f7a1888443c53af51f684942e68f

        SHA1

        dc0f5d507096a5dd4213a248dcf7206eb1e41afc

        SHA256

        a687faf1a76d374297eb55ceee91f39a1bb3d76d35bcf91ae0d6c2b37896da60

        SHA512

        5ec7bc0c37edfee97b4fb9741bdb9148d74156dbc9bc16bf2942a239250792a09ff2c7ad31487f8a5de4604d12fa4a4596daa1b6fb076921d2cc86d0d0bded60