Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 20:39

General

  • Target

    1c6c160b566a6c1052853bd76ec219f5_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    1c6c160b566a6c1052853bd76ec219f5

  • SHA1

    ce70c3ea101b622cacc88b884122a9ca272a264a

  • SHA256

    fc0b6092bd416af78ad70ce16162840bd41b4fba88117881a06d07b67d5e434c

  • SHA512

    ab352478d0230cb5ec1fc8eea184d0401490797abfe7474f2e8468f406b89f22cfc24d39365ab10519775833d754e2b7ad992eb95d929f21e588972e1dcf3444

  • SSDEEP

    1536:GmqGQT9mvmEScqlqmQzYvnZ26+xdWp7pw7bl:5W9m+EmiYvnZyxdWXw7

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c6c160b566a6c1052853bd76ec219f5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1c6c160b566a6c1052853bd76ec219f5_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Loads dropped DLL
      PID:1888
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\DEL.bat
      2⤵
      • Deletes itself
      PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\DEL.bat

    Filesize

    210B

    MD5

    d5365ad1c37e283e3cee081785adb691

    SHA1

    59635cc0ebeeaaeb0303af9df01dcb89b1aebb43

    SHA256

    61282c61c8a788a941b46fcc391c0861c87c542368eceaa9934881a71d1e50b6

    SHA512

    9dfd7ac3ab4ce0cf2072122e43538f8408aea314e142babf11cfc7589e2c16f86691acab6d56805d641a58847bf575c0cebffe255d6e3dfee966c5dcf7d87035

  • \Windows\SysWOW64\javacypsts.dll

    Filesize

    18KB

    MD5

    9cf28f34a25cfb787f20a58997b4042b

    SHA1

    6715065f525496dfea8ae917acd3db7b11cc912b

    SHA256

    b727b0bc04a24711eabddd64e1d7a481b705a4c2ead0e45103461c276605366d

    SHA512

    3c9505383aaa26cf87e6ebb35506328be5ca1d0625a84c363705d8bed6494ba56674c4963ec449feba197ee466ad89d7cb046ba846dd2d2c786b43b589e82703

  • memory/840-0-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/840-14-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1888-2-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1888-10-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1888-16-0x0000000000020000-0x000000000002A000-memory.dmp

    Filesize

    40KB