Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    26/06/2024, 22:19

General

  • Target

    13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe

  • Size

    239KB

  • MD5

    13ad479f43406e00dd2eb7599be31527

  • SHA1

    5aaf553aee6b73fe0f46f74987101647b002706a

  • SHA256

    0d1dc5f2f30c132fa08fb762029057458f71c115c71eae8184e45a87e2607353

  • SHA512

    44fcbc5081c0dde42828c2a6fcc4fb79a936253a6788de4809e98502df82c75dbd48ae315c753461b194bf1f98986fa9b6fea89ca0c6ae59bb3691fa1da303b2

  • SSDEEP

    3072:A7mXb6igvd+2s7OBRgaPee7Ly2+XysjmyzSu8GSp0G2Rc+jUoC+:Amb6igk1O/gpe7GP5jSRucY

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 5 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\svcchost.exe
      "C:\Windows\svcchost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2620
      • C:\Windows\SysWOW64\REG.exe
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        3⤵
        • Impair Defenses: Safe Mode Boot
        • Modifies registry key
        PID:2616
    • C:\Windows\exploree.exe
      "C:\Windows\exploree.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2116
    • C:\Windows\hsl.exe
      "C:\Windows\hsl.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 132
        3⤵
        • Program crash
        PID:1752
    • C:\Windows\scss.exe
      "C:\Windows\scss.exe"
      2⤵
      • Modifies firewall policy service
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of UnmapMainImage
      PID:2572
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\154.bat" "
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:2896

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\154.bat

      Filesize

      166B

      MD5

      ca936c1244fd78ec8a6b5f23c92f9f1b

      SHA1

      644f0296439c1c175d399a32bc8929cb692579a6

      SHA256

      076b593a8d250953a255ef4cead2ee673b36e194ccf5e24152ce8b4c2359a925

      SHA512

      44f179e904cfc5d1f8293ec5fe5768a438735850bb93e9da3eb3f956eb857dd86c05b15b1aa0c968a2bf4b3b473d71aa88c92c48a9db401e0d2cb7df6fc87c35

    • C:\Windows\exploree.exe

      Filesize

      35KB

      MD5

      31112dedf5f25bac5aef4c8e344b48f2

      SHA1

      104551348e450ea824d9469afc0189a342140290

      SHA256

      d346171cee29cb55204afeb44284480ebcbddee8000ec944a63f2655f0dcdb65

      SHA512

      2ee76e84b70109906ff37cafe58c24ea0b88a2846a43290fa7ecd3abc3b754072dddea8af2b2375df10a7da4c97ceccc03d6f4fcd8243f94b7838072cf03262f

    • C:\Windows\hsl.exe

      Filesize

      93KB

      MD5

      bb389d8f47db4a872087c37249b5347a

      SHA1

      8b6c0121e46b4af94c941d25fac2f2e7a3092b8d

      SHA256

      7490c42628d70c748b16387e66c33b5989c24b6531a949d5fa10d3069d90adad

      SHA512

      7b6c0ba266a9a611c2e713aeceb0b78a0400a405dbf48482fd0cbe00ea674591e324ffadb7900d4e9d444e81522c111e982410ebfe2f98e9eb2870df9a0f3950

    • C:\Windows\scss.exe

      Filesize

      42KB

      MD5

      875d7d741e71b84e8d620e96b442ffc8

      SHA1

      34b1d6223940df1e2c47e441a84451d11c24ed6a

      SHA256

      9820f333dbe7cbd6ba2064999e7368efc3b4ce114925ede6d96d5fdfe3b1e909

      SHA512

      7b0e3264197e52ebf6b701cb051f749008bf489ff02133b38e4a71111309d1eff3084b2428cc3ec0dce6472a2d0ac4ad3e6430daf701f2777f1852c69fd72180

    • C:\Windows\svcchost.exe

      Filesize

      50KB

      MD5

      96536128805788b05b9335d674c19e1d

      SHA1

      a44cde59321c0f9bb07ef975efc8370c8a51e23e

      SHA256

      69693ac781a21bad65c7962e0afe1157c7cfcd088675a62a6afd92347178f2be

      SHA512

      537e856222506c1200796ce750bfd12bb9933558f1e484c1cc4f1dfc2610385cfb4d2d0f72a9f4d125d97b47060289ff480fedfe64fb6e96c9c302cdd9ab6e1f

    • memory/2116-37-0x0000000013140000-0x000000001317E000-memory.dmp

      Filesize

      248KB

    • memory/2116-36-0x0000000017180000-0x0000000017187000-memory.dmp

      Filesize

      28KB

    • memory/2116-22-0x0000000000400000-0x0000000000489000-memory.dmp

      Filesize

      548KB

    • memory/2116-44-0x00000000003B0000-0x0000000000531000-memory.dmp

      Filesize

      1.5MB

    • memory/2116-45-0x0000000013140000-0x000000001317E000-memory.dmp

      Filesize

      248KB

    • memory/2572-47-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2572-51-0x0000000017180000-0x0000000017189000-memory.dmp

      Filesize

      36KB

    • memory/2572-74-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/2572-49-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/2620-67-0x0000000003150000-0x000000000319B000-memory.dmp

      Filesize

      300KB

    • memory/2620-68-0x0000000002DD0000-0x0000000002DF6000-memory.dmp

      Filesize

      152KB

    • memory/2620-65-0x0000000003150000-0x000000000319C000-memory.dmp

      Filesize

      304KB

    • memory/2620-66-0x0000000003150000-0x000000000319C000-memory.dmp

      Filesize

      304KB

    • memory/2668-50-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/2668-48-0x0000000017180000-0x0000000017194000-memory.dmp

      Filesize

      80KB

    • memory/2668-35-0x0000000000400000-0x000000000044B000-memory.dmp

      Filesize

      300KB

    • memory/2668-76-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/2736-21-0x00000000026B0000-0x0000000002739000-memory.dmp

      Filesize

      548KB

    • memory/2736-3-0x0000000000400000-0x000000000043B000-memory.dmp

      Filesize

      236KB

    • memory/2736-11-0x00000000021D0000-0x000000000221C000-memory.dmp

      Filesize

      304KB

    • memory/2736-0-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/2736-46-0x00000000026B0000-0x00000000026D6000-memory.dmp

      Filesize

      152KB

    • memory/2736-1-0x0000000017180000-0x00000000171BB000-memory.dmp

      Filesize

      236KB

    • memory/2736-60-0x0000000000400000-0x000000000043B000-memory.dmp

      Filesize

      236KB

    • memory/2736-10-0x00000000021D0000-0x000000000221C000-memory.dmp

      Filesize

      304KB

    • memory/2736-34-0x00000000026B0000-0x00000000026FB000-memory.dmp

      Filesize

      300KB

    • memory/3052-13-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/3052-24-0x0000000017180000-0x000000001718C000-memory.dmp

      Filesize

      48KB

    • memory/3052-25-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/3052-75-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/3052-23-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB