Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 19:28

General

  • Target

    1c3ace0b119de10f6ca58cb6cc5c140f_JaffaCakes118.exe

  • Size

    96KB

  • MD5

    1c3ace0b119de10f6ca58cb6cc5c140f

  • SHA1

    a54266d4f447f02988b0ad287c6c27d7fdadfe71

  • SHA256

    38eb8291e5f7340c97495985d73434d949350b17d815091bf40a7838b7b171bb

  • SHA512

    ec65e5bf2b805e137c7d0c7f6068bfe334adfb815860fc2a77f46ad8e733bb30bb2527296d4c5ff3122351673ed4dab2866266d837213a5d665681cc19a8cede

  • SSDEEP

    1536:PxZEg5239tyVQO8P8ychNwjj3RJNEo/knRzdnynE7RldNEP8lijOeDNIjni:PTE/3elychkzR3Ek65RldqDCni

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c3ace0b119de10f6ca58cb6cc5c140f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1c3ace0b119de10f6ca58cb6cc5c140f_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Users\Admin\zauro.exe
      "C:\Users\Admin\zauro.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\zauro.exe

    Filesize

    96KB

    MD5

    2ee57ca620fd15b5bd5c8cac27ea045e

    SHA1

    95e2ad92b3a70b5d6fdc6341b29b19d00ed997d1

    SHA256

    5e0da919f2fcb361215658206a7abf9ba3855cfb0ff319a532f4d272baf63276

    SHA512

    d4b3f0efdbd6d3308a09a568d0e4a087727bd2cd3e171e00f7063a436b7ce97299d11336f7a7af6af6e629703d60ba39be65eff06e26c6257d83687e1481c304