Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 13:38

General

  • Target

    1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe

  • Size

    128KB

  • MD5

    1b80613ac090d4eecfdd6554d4290b7b

  • SHA1

    52ee1d680eb6394897e5854027f2eadc76acba2e

  • SHA256

    f7f8376c3a4289f5ba02262cad0889c8f8572b0dac37226e37e71132a20ed825

  • SHA512

    c2399e167628b579addfea8250ea63475f70bafc51c2bca4d0bc4fe2d82e7623ac008e1121f805a3a082ca8d4db4286450cfe61abc7d7f43cb1c84a0bf834d95

  • SSDEEP

    3072:5zrl/nonoroxGDi73tCg3qilL42wA52jOMkrc0:5zrl/nonoroxGDFg3qilL42IjOPrD

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 10 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
          "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
            "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\1b80613ac090d4eecfdd6554d4290b7b_JaffaCakes118.exe
            5⤵
              PID:2468

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

      Filesize

      128KB

      MD5

      3148aa6dcd76cdb640a2defe483231a7

      SHA1

      30ec10387d43eaaeebc81b71a3a375c3f863ca48

      SHA256

      7c872dbe25b959fed38a4b35afea0d6aae9f5fc5c89072c093d22750fb938e62

      SHA512

      366819cf6c566c4973be00cf63bee6566f96f156d7dcfa195b2766cbde8b5f90f1a2bb986b9c605088ef2189c9f9445359883257eae1af07ce959e36e5f7386d

    • memory/2220-14-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-12-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2220-8-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-6-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-4-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-2-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-0-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2220-42-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2544-45-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB