Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 03:56

General

  • Target

    029a591fb87c8ebbd7588414b7a03f9d_JaffaCakes118.exe

  • Size

    691KB

  • MD5

    029a591fb87c8ebbd7588414b7a03f9d

  • SHA1

    1902c03277aa90fd50e79985c8d3e0c03662f72e

  • SHA256

    7350461a9be443ef4cf08a9c303c13a08c12cc0b90fc15f71840f05565aa52f2

  • SHA512

    85f0743d447d3e5e36403a66c883698961ef0eab28ca747f1a683dfc2ebb57b953eba6050268ca6c3477f7f977fafd738487af42897927afa89c60064cbadbf2

  • SSDEEP

    12288:W6SUiOOt9+jCe2v3Qn4W/bLqt79BC5erwUZ8WpwJF3Z4mxxUDqVTVOCA:W6Sht9yCe2K5vqJC5erwfW6JQmXDVTzA

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\029a591fb87c8ebbd7588414b7a03f9d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\029a591fb87c8ebbd7588414b7a03f9d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\uninstal.bat
        3⤵
          PID:2552
    • C:\Windows\Hacker.com.cn.exe
      C:\Windows\Hacker.com.cn.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        2⤵
          PID:1672

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\uninstal.bat

        Filesize

        150B

        MD5

        67e4ea2c3e65d3236c8266b9c116f67f

        SHA1

        7e87f925ccd68b2b7c9af9f92e118db1990234f9

        SHA256

        2dff6c390d03870cec06d16fe0191475fb87ad2330b78d03c15e7ff0bed8f00c

        SHA512

        1a3cf0443e932b9b57f32531b3d61c917b9eec19a4ba73336011041e16a0022c5e62b2c768b34a0bdc08ffd75bbaa0338719577001496c9de8a5638420b0a229

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe

        Filesize

        777KB

        MD5

        4ceb88b18a18bf88197d6c9032c565ba

        SHA1

        33492b16a638a794be51c1331a97c13e94bc7f04

        SHA256

        64a1b05197833f8af011c935b46c41addb9d4d23c89e63a9a5d9c99a93bf2c54

        SHA512

        5e79db8e46c1796f7fb859253c98ab550c9d69e78c0c8429cfdb1d8c542a076435af23507e836167a4d37b42ae2476f13c39ae9da3bce1082f4120f71e8d5929

      • memory/2368-0-0x0000000001000000-0x0000000001113000-memory.dmp

        Filesize

        1.1MB

      • memory/2368-1-0x0000000000710000-0x0000000000764000-memory.dmp

        Filesize

        336KB

      • memory/2368-35-0x00000000009F0000-0x00000000009F1000-memory.dmp

        Filesize

        4KB

      • memory/2368-37-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-36-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-34-0x00000000008A0000-0x00000000008A1000-memory.dmp

        Filesize

        4KB

      • memory/2368-33-0x00000000009D0000-0x00000000009D1000-memory.dmp

        Filesize

        4KB

      • memory/2368-32-0x00000000002B0000-0x00000000002B1000-memory.dmp

        Filesize

        4KB

      • memory/2368-31-0x00000000002D0000-0x00000000002D1000-memory.dmp

        Filesize

        4KB

      • memory/2368-30-0x00000000009E0000-0x00000000009E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-29-0x0000000000870000-0x0000000000871000-memory.dmp

        Filesize

        4KB

      • memory/2368-28-0x0000000000890000-0x0000000000891000-memory.dmp

        Filesize

        4KB

      • memory/2368-27-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-26-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-25-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-38-0x0000000000A60000-0x0000000000A61000-memory.dmp

        Filesize

        4KB

      • memory/2368-24-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-23-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-22-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-21-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-20-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-19-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-18-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-17-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-16-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-15-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-14-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-13-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-39-0x0000000000A40000-0x0000000000A41000-memory.dmp

        Filesize

        4KB

      • memory/2368-12-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-11-0x0000000000290000-0x0000000000291000-memory.dmp

        Filesize

        4KB

      • memory/2368-10-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-9-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-8-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2368-7-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2368-6-0x0000000000180000-0x0000000000181000-memory.dmp

        Filesize

        4KB

      • memory/2368-5-0x0000000000190000-0x0000000000191000-memory.dmp

        Filesize

        4KB

      • memory/2368-4-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

      • memory/2368-3-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

      • memory/2368-59-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-62-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-61-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-60-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-58-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-40-0x0000000000A20000-0x0000000000A21000-memory.dmp

        Filesize

        4KB

      • memory/2368-57-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-56-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-55-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-54-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-53-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-52-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-51-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-50-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-49-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/2368-48-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-47-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-46-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-45-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-44-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/2368-43-0x0000000000A70000-0x0000000000A71000-memory.dmp

        Filesize

        4KB

      • memory/2368-42-0x0000000000A80000-0x0000000000A81000-memory.dmp

        Filesize

        4KB

      • memory/2368-41-0x0000000000A10000-0x0000000000A11000-memory.dmp

        Filesize

        4KB

      • memory/2368-2-0x0000000000250000-0x0000000000251000-memory.dmp

        Filesize

        4KB

      • memory/2368-85-0x0000000001000000-0x0000000001113000-memory.dmp

        Filesize

        1.1MB

      • memory/2368-86-0x0000000000710000-0x0000000000764000-memory.dmp

        Filesize

        336KB

      • memory/2548-88-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB

      • memory/2768-84-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB