Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/06/2024, 22:47

General

  • Target

    13c199c208b022940e06b654f968c5d1_JaffaCakes118.exe

  • Size

    46KB

  • MD5

    13c199c208b022940e06b654f968c5d1

  • SHA1

    a9decf492b68a1a64d14bbbfbdfdcd105809b257

  • SHA256

    9a78b873c2aa291b1834b8ddb741b78ac2f564174dd58d223f9fb748f6d10532

  • SHA512

    aaabf509e94289bfb5143c9272b934a8a089a004d87dfe7b9372b007c333812340ef862d5e6fe2cc8f5aed92879d4dfd85783905a7a85570c96f6e95ee457b9b

  • SSDEEP

    768:dbI0l3A7f5HbZ+r9kotEv8cXXsiTbpqvytL/UPRx5OH0bu8RaATXxBO+S5iBayZI:Rg57poteMi52KLSRxA6u8Ram9S5ivI

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies WinLogon 2 TTPs 8 IoCs
  • Drops file in System32 directory 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\13c199c208b022940e06b654f968c5d1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\13c199c208b022940e06b654f968c5d1_JaffaCakes118.exe"
        2⤵
        • Impair Defenses: Safe Mode Boot
        • Loads dropped DLL
        • Modifies WinLogon
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\SysWOW64\emul65.dll

      Filesize

      33KB

      MD5

      ab8730f9baeb55d4e12abd5275106270

      SHA1

      2a796b58a0e4001c4c958e6d5a38273877102422

      SHA256

      d3a4ba8d0837e6bf6a1ba4648e1f9e2f4980ac763e6a2537514e55de906e1b41

      SHA512

      592f89c0153a1e00027772d373c835acc7d3490b180a9a2025618635bfef6041c088780e0e11d567856868944157b095e142aab1968062ae65a6dc09c4b649cc

    • memory/1260-15-0x00000000025B0000-0x00000000025B1000-memory.dmp

      Filesize

      4KB

    • memory/1660-12-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB

    • memory/1660-18-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/1660-19-0x0000000010000000-0x000000001004D000-memory.dmp

      Filesize

      308KB