Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 08:46

General

  • Target

    0d6d6fe2f3666f22ae1773e0cd7c5bab_JaffaCakes118.exe

  • Size

    401KB

  • MD5

    0d6d6fe2f3666f22ae1773e0cd7c5bab

  • SHA1

    9c2abce854fab21044e4d90dbbfcf5b96c9ce0ac

  • SHA256

    30193d6ac17ae011fe6c3524130cb6bc44da7ef2dd081e3efbcb4b92ef1a2fec

  • SHA512

    6270ff3783f6bfbb36e34d69e425a2a018637058ac0ae3fde51052319bcdd2b9202d07aad1be4bc9c3d2fdfcf5516babfda7a8967bd85f5affcb3fe08c4e5b86

  • SSDEEP

    12288:w9IEr7LVvNJ0pelp1cRImysfO1w68hQaX1:V6FvYelTmyyOS6IQaF

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d6d6fe2f3666f22ae1773e0cd7c5bab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d6d6fe2f3666f22ae1773e0cd7c5bab_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wucault.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wucault.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wucault.exe

    Filesize

    237KB

    MD5

    00394098c6b4a6ece2472d5a5b16dc40

    SHA1

    c41649003d6d8c6562b79c9e64213bf8c120802e

    SHA256

    25db631b0c979e5c7c1270304381ac1c1932fe4c97c01b8cc5275ef6ca4258f5

    SHA512

    a8ebed74424885388fd0bfa1ebd873195ca13bbb94bf7d1760ca2be0124d69bd6b2628d94f3c18e09632f75413f4c7ed6f4d00bc54156972bf0e14e6a82ca0ff

  • memory/1560-10-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/2752-12-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2752-13-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-14-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-15-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-16-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-17-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-18-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-19-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-20-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-21-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-22-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-23-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-24-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-25-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2752-26-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB