Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 14:34

General

  • Target

    06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe

  • Size

    4.9MB

  • MD5

    06df0980fff3b950dcf02359b7162ee5

  • SHA1

    d2a9de6ae30f40243d941fe747da2f20790b6e62

  • SHA256

    0590894e2ef5e46ca7044fec6df83d362021c7a0798aed4aa38baa6e2fe066ed

  • SHA512

    46f815717388a4bd273dcae7df9577a37b8089b8bc2a17b087ea7418d24af2a07722072ffbe2374f6a0697780fddf9e5fb360302b1452143b87aba761681f4e8

  • SSDEEP

    98304:3Mtb7/SrJkyTl9KMkEfj9gMWRW1xpF27ZOidJf9a52DLsz8RG3slJu+NEOt:QurJR9/JgtWjpF2VtdJ852BceTNvt

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
  • Uses Session Manager for persistence 2 TTPs 3 IoCs

    Creates Session Manager registry key to run executable early in system boot.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\06df0980fff3b950dcf02359b7162ee5_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /TN startt /f
      2⤵
        PID:2972
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn startt /tr c:\sys.bat /sc onstart /ru system
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2680
      • C:\Windows\SysWOW64\sc.exe
        sc delete GbpSv
        2⤵
        • Launches sc.exe
        PID:2760
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
        2⤵
        • Uses Session Manager for persistence
        PID:2560
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
        2⤵
        • Uses Session Manager for persistence
        PID:2912
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
        2⤵
        • Uses Session Manager for persistence
        PID:2688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1740-0-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-3-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-2-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-1-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-7-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-6-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-5-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-4-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-8-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-9-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-10-0x0000000075E11000-0x0000000075E12000-memory.dmp

      Filesize

      4KB

    • memory/1740-11-0x0000000075E10000-0x0000000075E1A000-memory.dmp

      Filesize

      40KB

    • memory/1740-13-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-14-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-15-0x000000007EF50000-0x000000007EFAC000-memory.dmp

      Filesize

      368KB

    • memory/1740-17-0x0000000075E10000-0x0000000075E1A000-memory.dmp

      Filesize

      40KB

    • memory/1740-16-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-18-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-19-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-20-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-21-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-22-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-23-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-24-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-25-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-26-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-28-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB

    • memory/1740-29-0x0000000000400000-0x000000000215B000-memory.dmp

      Filesize

      29.4MB