Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 09:57

General

  • Target

    04f28f8bc08ee9a07052713b813e5ea4_JaffaCakes118.exe

  • Size

    15KB

  • MD5

    04f28f8bc08ee9a07052713b813e5ea4

  • SHA1

    ffb811af29ced07121e8985481e39fa650979b9d

  • SHA256

    46bb10b0974c71eed792c5fb84e67a7011427b5814cef38e1665de1e7842cbf3

  • SHA512

    217997494edc392ed7ab751a7b2f26063a8efc3c17f112bc7f32ca91aa511dfe9b52ef8dbae25943713be89609d20b4b03a42e04cf0b04053b07f03ef9fa2a42

  • SSDEEP

    384:1Bo/tghaQ3NDoPYGWt7sAQuvKWuAVFYlGf80B:1BmtgDqfWtsA9oAeu

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04f28f8bc08ee9a07052713b813e5ea4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04f28f8bc08ee9a07052713b813e5ea4_JaffaCakes118.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\7E92.tmp.bat
      2⤵
      • Deletes itself
      PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7E92.tmp.bat

    Filesize

    207B

    MD5

    35b0143c95bf3f17c181a8869be10198

    SHA1

    23b929a2ecb8fd8e7e7979ad5ddb7f769445a185

    SHA256

    a9612c3432db166c5fb2a53e30ac5205223b19a3fca790e87f0cac52415b7a99

    SHA512

    d96346333021e6a5cec1770f29de67bcd9c38fa5e87fb47b3f9ce23910dbf9f29287cec2ec3bff79b4488a423514850e12e3b82cf7af0d71f55f1a232eaae8d6

  • C:\Windows\SysWOW64\lweurqhx.nls

    Filesize

    428B

    MD5

    cf948e1aff20b24cf98392d3cf768762

    SHA1

    61d9942dab590f5184ef8291178366a305be72b4

    SHA256

    f58dd2d67d97f26968b8d9c24c2f616d8d5d69840443e87e715a700be7ef3d33

    SHA512

    94ef3b727fc9145019dca7da4639e909d250199b89f7535b481e5a059676762f211485b2bd6b823da3c3b7d55cd5e18cd10627878b6e77e860bcb73d0aae68f4

  • C:\Windows\SysWOW64\lweurqhx.tmp

    Filesize

    776KB

    MD5

    620d3806720af65107a336857674d246

    SHA1

    6500af9c3fb6d72f883c9ad2d85a45e7cbf18d27

    SHA256

    66cf8165bccd5b0156b275a16f2bc7e442c345cc42f31cd3ebb201ce80acccf3

    SHA512

    65b12ceb1a002d90cdb105119135e58a855b5005da7715b10d86afddeb779d91ba1ee7940f373cc67ecbebbe4432706c03dc94ad0145b305b4f37f3d81c4ce57

  • memory/2432-16-0x0000000020000000-0x0000000020009000-memory.dmp

    Filesize

    36KB

  • memory/2432-25-0x0000000020000000-0x0000000020009000-memory.dmp

    Filesize

    36KB