Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27/06/2024, 23:24

General

  • Target

    17ecd2482ee7117bb01d500ed1dbc23f_JaffaCakes118.exe

  • Size

    88KB

  • MD5

    17ecd2482ee7117bb01d500ed1dbc23f

  • SHA1

    76507cec7f81a04ecba0a2542ed6c6f679a26a9f

  • SHA256

    86ab82676be16232b60514b0673f385e883af6f24a0ad43a98904c088d0292e6

  • SHA512

    f09497b9c0e3afd19979758e34407dff710b93c8dd5d4b3349441faad87ed610024c025c22a4424f93e67f9fef60a61d68728207cb9d86d92960187acd5df0bc

  • SSDEEP

    1536:KTS4t3A4HTqgpkY+0MMpqkRKihKs9q2+/u+shQ9sb4+wIyDYxBQuH6vd0J+yNCWj:KTU4GEkrMpJVLqW+sicgYb6vd0/G

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17ecd2482ee7117bb01d500ed1dbc23f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17ecd2482ee7117bb01d500ed1dbc23f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\dftdoxl.dll",Startup
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\dftdoxl.dll",iep
        3⤵
        • Loads dropped DLL
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\dftdoxl.dll

    Filesize

    88KB

    MD5

    ef100aef1f101e81cbae6f9cdcb58127

    SHA1

    548faa930db08b9bbe7665f8b3dab1f275803c2c

    SHA256

    98b0145d246bc2aa1c2134ae04d9d04a7bfc620fb5fd46276513a9d6945ecbf5

    SHA512

    bcc6f51def515971921cda11f9e8e7c8091c66e289a24b12f658927df9c5d5e60512433d7432ab7eb3cdaf7c98dec53fb652dfb13158c27c98edbe890036babe

  • memory/1640-14-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/1640-19-0x0000000002000000-0x0000000002040000-memory.dmp

    Filesize

    256KB

  • memory/1640-29-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/1640-10-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/1640-12-0x0000000002000000-0x0000000002040000-memory.dmp

    Filesize

    256KB

  • memory/1640-11-0x0000000002000000-0x0000000002040000-memory.dmp

    Filesize

    256KB

  • memory/1640-25-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/1680-18-0x0000000001CE0000-0x0000000001D20000-memory.dmp

    Filesize

    256KB

  • memory/1680-0-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/1680-2-0x0000000001CE0000-0x0000000001D20000-memory.dmp

    Filesize

    256KB

  • memory/1680-17-0x0000000001CE0000-0x0000000001D20000-memory.dmp

    Filesize

    256KB

  • memory/1680-13-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/1680-1-0x0000000001CE0000-0x0000000001D20000-memory.dmp

    Filesize

    256KB

  • memory/2668-28-0x0000000001DA0000-0x0000000001DE0000-memory.dmp

    Filesize

    256KB

  • memory/2668-27-0x0000000001DA0000-0x0000000001DE0000-memory.dmp

    Filesize

    256KB

  • memory/2668-30-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/2668-33-0x0000000001DA0000-0x0000000001DE0000-memory.dmp

    Filesize

    256KB